Text

Transmittal of Revision 10 to the Clinton Power Station Technical Specifications Bases
	ML062340346
Person / Time
Site:	Clinton
Issue date:	08/16/2006
From:	Simpson P; AmerGen Energy Co, Exelon Generation Co
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	U-603781
	Download: ML062340346 (146)
	v • d • e

Amer G- ,i An Exelon Company Clinton Power Station R. R. 3, Box 228 Clinton, IL 61727 10 CFR 50.71 (e)

U-603781 August 16, 2006 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D.C. 20555-0001 Clinton Power Station, Unit 1 Facility Operating License NRC Docket No. 50-461

Subject:

Transmittal of Revision 10 to the Clinton Power Station Technical Specifications Bases In accordance with Clinton Power Station (CPS) Technical Specification 5.5.11, 'Technical Specifications (TS) Bases Control Program," AmerGen Energy Company (AmerGen), LLC is transmitting the revised pages constituting Revision 10 to the CPS TS Bases. The changes associated with this revision were processed in accordance with CPS TS 5.5.11, which became effective with Amendment No. 95 to the CPS Operating License. Compliance with CPS TS 5.5.11 requires updates to the TS Bases to be submitted to the NRC at a frequency consistent with 10CFR50.71, "Maintenance of records, making of reports," paragraph (e).

There are no regulatory commitments in this letter.

Should you have any questions concerning this information, please contact Mr. Jim Peterson at (217) 937-2810.

Rsectf ully, Patrick R. Simpson Acting Regulatory Assurance Manager Clinton Power Station JLP\blf Attachment - Revision 10 to the CPS Technical Specification Bases AQcoI

Amergen Energy Company, LLC Clinton Power Station U-603781 Page 2 of 2 cc: Regional Administrator - NRC Region III NRC Senior Resident Inspector - Clinton Power Station Illinois Emergency Management Agency - Division of Nuclear Safety

Ii.- -- A Attachment to U-603781 Clinton Power Station, Unit 1 Revision 10 to the CPS Technical Specifications Bases Page Listing iv v B3.0-5 83.0-6 B3.0-6a B3.0-6b B3.0-14 83.0-15 B3.1-38 B3.1-39 B3.1-39a B3.1-39b B3.1-40 B3.1-43 B3.1-43a B3.1-45 B3.1-46 B3.1-47 B3.1-48 B3.3-1 B3.3-2 B3.3-3 B3.3-5 B3.3-27 B3.3-27a B3.3-27b B3.3-28 B3.3-29 B3.3-30 B3.3-38 B3.3-48 B3.3-53 83.3-54 B3.3-55 83.3-59 B3.3-62 13.3-64 83.3-73 B3.3-74 B3.3-84 B3.3-85 B3.3-91 B3.3-92 B3.3-120 B3.3-120a B3.3-120b B3.3-121 83.3-133 B3.3-134 63.3-157 B3.3-168 63.3-171 B3.3-172 B3.3-173 B3.3-184 63.3-185 13.3-189 B3.3-195 83.3-196 83.3-206 B3.3-207 B3.3-208 63.3-210 63.3-213 83.3-213a B3.3-213b 83.3-214 63.3-224 B3.3-225a B3.3-226 B3.3-229 B3.3-235 B3.3-236 83.4-11 83.4-21 63.4-22 83.4-36 B3.4-37 83.4-38 83.4-41 83.5-6 B3.5-11 B3.5-12 83.5-14 63.5-22 83.5-23 63.5-25 83.5-26 83.6-25 83.6-26 B3.6-28a 83.6-38 83.6-42 63.6-43 83.6-44 B3.6-45 B3.6-46 B3.6-47 83.6-65 B3.6-66 83.6-67 83.6-68 B3.6-69 B3.6-70 B3.6-71 B3.6-74 B3.6-75 B3.6-76 63.6-77 63.6-80 83.6-82 B3.6-88 B3.6-88a B3.6-95 63.6-100 B3.6-101 83.6-121 63.6-132 B3.7-6 133.7-9 B3.7-15 83.7-16 83.7-21 B3.7-27 13.8-5 B3.8-9 B3.8-17 83.8-18 B3.8-19a 83.8-21 63.8-22 13.8-23 83.8-24 B3.8-25 B3.8-26 B3.8-27 13.8-28 B3.8-29 83.8-30 B3.8-56 B3.8-57 83.8-95 B3.8-97

TABLE OF CONTENTS B 3.4 REACTOR COOLANT SYSTEM (RCS) (continued)

B 3.4.3 Jet Pum ps ............................................................................................................. B 3.4-13 B 3.4.4 Safety/Relief Valves (S/RVs) .............................................................................. B 3.4-17 B 3.4.5 RCS Operational LEAKAGE .............................................................................. B 3.4-23 B 3.4.6 RCS Pressure Isolation Valve (PIV) Leakage ..................................................... B 3.4-28 B 3.4.7 RCS Leakage Detection Instrumentation ............................................................. B 3.4-33 B 3.4.8 RCS Specific Activity .......................................................................................... B 3.4-39 B 3.4.9 Residual Heat Removal (RHR) Shutdown Cooling System -Hot Shutdown ............................................................................... B 3.4-43 B 3.4.10 Residual Heat Removal (RHR) Shutdown Cooling System- Cold Shutdown ............................................................................. B 3.4-48 B 3.4.11 RCS Pressure and Temperature (P/T) Limits ...................................................... B 3.4-53 B 3.4.12 Reactor Steam Dome Pressure ............................................................................. B 3.4-62 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM ................................................................. 3.5-I 3.5.1 ECCS - O perating ................................................................................................. 3.5-1 3.5.2 ECCS - Shutdown ................................................................................................. 3.5-6 3.5.3 RC IC System ........................................................................................................ 3.5-10 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM ..................................................... B 3.5-1 B 3.5.1 ECCS -Operating ................................................................................................. B 3.5-1 B 3.5.2 ECCS -Shutdown ................................................................................................. B 3.5-15 B 3.5.3 RCIC System ........................................................................................................ B 3.5-21 3.6 CONTAINMENT SYSTEMS ...................................................................................... 3.6-1 3.6.1.1 Primary Containment ........................................................................................... 3.6-1 3.6.1.2 Primary Containment Air Locks .......................................................................... 3.6-3 3.6.1.3 Primary Containment Isolation Valves (PCIVs) .................................................. 3.6-9 3.6.1.4 Primary Containment Pressure ............................................................................ 3.6-20 3.6.1.5 Primary Containment Air Temperature ............................................................... 3.6-21 3.6.1.6 Low-Low Set (LLS) Valves ................................................................................. 3.6-22 3.6.1.7 Residual Heat Removal (RHR) Containment Spray System ............................... 3.6-24 3.6.1.8 D eleted .............................................................................................................. 3.6-26 3.6.1.9 Feedwater Leakage Control System (FWLCS) ................................................... 3.6-27a 3.6.2.1 Suppression Pool Average Temperature .............................................................. 3.6-28 3.6.2.2 Suppression Pool Water Level ............................................................................. 3.6-31 3.6.2.3 Residual Heat Removal (RHR) Suppression Pool Cooling ................................. 3.6-32 3.6.2.4 Suppression Pool Makeup (SPMU) System ........................................................ 3.6-34 3.6.3.1 Deleted ............................................................................................................... 3.6-36 3.6.3.2 Primary Containment and Drywell Hydrogen Igniters ........................................ 3.6-38 (continued)

CLINTON Revision No. 10-5 iv

TABLE OF CONTENTS 3.6 CONTAINMENT SYSTEMS (continued) 3.6.3.3 Containment/Drywell Hydrogen Mixing Systems ............................................... 3.6-41 3.6.4.1 Secondary Containment ....................................................................................... 3.6-43 3.6.4.2 Secondary Containment Isolation Dampers (SCIDs) .......................................... 3.6-47 3.6.4.3 Standby Gas Treatment (SGT) System ................................................................ 3.6-51 3.6.5.1 D ryw ell ............................................................................................................... 3.6-54 3.6.5.2 Drywell Air Lock ................................................................................................. 3.6-56 3.6.5.3 Drywell Isolation Valves ..................................................................................... 3.6-61 3.6.5.4 Drywell Pressure .................................................................................................. 3.6-66 3.6.5.5 Drywell Air Temperature ..................................................................................... 3.6-67 3.6.5.6 Drywell Post- LOCA Vacuum Relief System ..................................................... 3.6-68 B 3.6 CONTAINMENT SYSTEMS ...................................................................................... B 3.6-1 B 3.6.1.1 Primary Containment .................................................................................................... B 3.6-1 B 3.6.1.2 Primary Containment Air Locks ................................................................................... B 3.6-6 B 3.6.1.3 Primary Containment Isolation Valves (PCIVs) .......................................................... B 3.6-15 B 3.6.1.4 Primary Containment Pressure ..................................................................................... B 3.6-29 B 3.6.1.5 Primary Containment Air Temperature ........................................................................ B 3.6-32 B 3.6.1.6 Low-Low Set (LLS) Valves ......................................................................................... B 3.6-35 B 3.6.1.7 Residual Heat Removal (RHR) Containment Spray System ........................................ B 3.6-39 B 3.6.1.8 Deleted ................................................. .. .................... B 3.6-44 B 3.6.1.9 Feedwater Leakage Control System (FWLCS) ............................................................ B 3.6-47a B 3.6.2.1 Suppression Pool Average Temperature ...................................................................... B 3.6-48 B 3.6.2.2 Suppression Pool Water Level ..................................................................................... B 3.6-53 B 3.6.2.3 Residual Heat Removal (RHR) Suppression Pool Cooling .......................................... B 3.6-56 B 3.6.2.4 Suppression Pool Makeup (SPMU) System ................................................................. B 3.6-60 B 3.6.3.1 Deleted ........................................................................................... B 3.6-66 B 3.6.3.2 Primary Containment and Drywell Hydrogen Igniters ................................... B 3.6-72 B 3.6.3.3 Containment/Drywell Hydrogen Mixing System ......................................................... B 3.6-78 B 3.6.4.1 Secondary Containment ................................................................................................ B 3.6-83 B 3.6.4.2 Secondary Containment Isolation Dampers (SCIDs) ................................................... B 3.6-89 B 3.6.4.3 Standby Gas Treatment (SGT) System ........................................................................ B 3.6-96 B 3.6.5.1 D ryw ell ........................................................................................................................ B 3.6-102 B 3.6.5.2 Drywell Air Lock .......................................................................................................... B 3.6-106 B 3.6.5.3 Drywell Isolation Valves .............................................................................................. B 3.6-113 B 3.6.5.4 Drywell Pressure ........................................................................................................... B 3.6-122 B 3.6.5.5 Drywell Air Temperature ............................................................................................. B 3.6-125 B 3.6.5.6 Drywell Post-LOCA Vacuum Relief System ............................................................... B 3.6-128 (continued)

CLINTON Revision No. 10-5 V

LCO Applicability B 3.0 BASES LCO 3.0.3 assemblies in the associated fuel storage pool." Therefore, (continued) this LCO can be applicable in any or all MODES. If the LCO and the Required Actions of LCO 3.7.7 are not met while in MODE 1, 2, or 3, there is no safety benefit to be gained by placing the unit in a shutdown condition. The Required Action of LCO 3.7.7 of "Suspend movement of irradiated fuel assemblies in the associated fuel storage pool(s)" is the appropriate Required Action to complete in lieu of the actions of LCO 3.0.3. These exceptions are addressed in the individual Specifications.

LCO 3.0.4 LCO 3.0.4 establishes limitations on changes in MODES or other specified conditions in the Applicability when an LCO is not met. It allows placing the unit in a MODE or other specified condition stated in that Applicability (e.g., the Applicability desired to be entered) when unit conditions are such that the requirements of the LCO would not be met, in accordance with LCO 3.0.4.a, LCO 3.0.4.b, or LCO 3.0.4.c.

LCO 3.0.4.a allows entry into a MODE or other specified condition in the Applicability with the LCO not met when the associated ACTIONS to be entered permit continued operation in the MODE or other specified condition in the Applicability for an unlimited period of time. Compliance with Required Actions that permit continued operation of the unit for an unlimited period of time in a MODE or other specified condition provides an acceptable level of safety for continued operation. This is without regard to the status of the unit before or after the MODE change.

Therefore, in such cases, entry into a MODE or other specified condition in the Applicability may be made in accordance with the provisions of the Required Actions.

LCO 3.0.4.b allows entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering the MODE or other specified condition in the Applicability, and establishment of risk management actions, if appropriate.

The risk assessment may use quantitative, qualitative, or blended approaches, and the risk assessment will be conducted using the plant program, procedures, and criteria in place to implement 10 CFR 50.65(a)(4), which requires that risk impacts of maintenance activities be assessed and managed. The risk assessment, for the purposes of LCO 3.0.4.b, must take into account all inoperable Technical (continued)

CLINTON B 3.0-5 Revision No. 10-3

.8 LCO Applicability B 3.0 BASES LCO 3.0.4 Specification equipment regardless of whether the equipment (continued) is included in the normal 10 CFR 50.65(a)(4) risk assessment scope. The risk assessments will be conducted using the procedures and guidance endorsed by Regulatory Guide 1.182,

'Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants." Regulatory Guide 1.182 endorses the guidance in Section 11 of NUMARC 93-01, "Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants." These documents address general guidance for conduct of the risk assessment, quantitative and qualitative guidelines for establishing risk management actions, and example risk management actions. These include actions to plan and conduct other activities in a manner that controls overall risk, increased risk awareness by shift and management personnel, actions to reduce the duration of the condition, actions to minimize the magnitude of risk increases (establishment of backup success paths or compensatory measures), and determination that the proposed MODE change is acceptable. Consideration should also be given to the probability of completing restoration such that the requirements of the LCO would be met prior to the expiration of ACTIONS Completion Times that would require exiting the Applicability.

LCO 3.0.4.b may be used with single, or multiple systems and components unavailable. NUMARC 93-01 provides guidance relative to consideration of simultaneous unavailability of multiple systems and components.

The results of the risk assessment shall be considered in determining the acceptability of entering the MODE or other specified condition in the Applicability, and any corresponding risk management actions. The LCO 3.0.4.b risk assessments do not have to be documented.

The Technical Specifications allow continued operation with equipment unavailable in MODE 1 for the duration of the Completion Time. Since this is allowable, and since in general the risk impact in that particular MODE bounds the risk of transitioning into and through the applicable MODES or other specified conditions in the Applicability of the LCO, the use of the LCO 3.0.4.b allowance should be generally acceptable, as long as the risk is assessed and managed as stated above. However, there is a small subset of systems and components that have been determined to be more important to risk and use of the LCO 3.0.4.b allowance is prohibited. The LCOs governing these system and components contain Notes prohibiting the use of LCO 3.0.4.b by stating that LCO 3.0.4.b is not applicable.

(continued)

CLINTON B 3.0-6 Revision No. 10-3

£ S LCO Applicability B 3.0 BASES LCO 3.0.4 LCO 3.0.4.c allows entry into a MODE or other specified (continued) condition in the Applicability with the LCO not met based on a Note in the Specification which states LCO 3.0.4.c is applicable. These specific allowances permit entry into MODES or other specified conditions in the Applicability when the associated ACTIONS to be entered do not provide for continued operation for an unlimited period of time and a risk assessment has not been performed. This allowance may apply to all the ACTIONS or to a specific Required Action of a Specification. The risk assessments performed to justify the use of LCO 3.0.4.b usually only consider systems and components. For this reason, LCO 3.0.4.c is typically applied to Specifications which describe values and parameters (e.g., reactor coolant system specific activity),

and may be applied to other Specifications based on NRC plant-specific approval.

The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or components to OPERABLE status before entering an associated MODE or other specified condition in the Applicability.

The provisions of LCO 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS. In addition, the provisions of LCO 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that result from any unit shutdown. In this context, a unit shutdown is defined as a change in MODE or other specified condition in the Applicability associated with transitioning from MODE 1 to MODE 2 or 3, MODE 2 to MODE 3, and MODE 3 to MODE 4.

Upon entry into a MODE or other specified condition in the Applicability with the LCO not met, LCO 3.0.1 and LCO 3.0.2 require entry into the applicable Conditions and Required Actions until the Condition is resolved, until the LCO is met, or until the unit is not within the Applicability of the Technical Specification.

(continued)

CLINTON B 3.0-6a Revision No. 10-3

LCO Applicability B 3.0 BASES LCO 3.0.4 Surveillances do not have to be performed on the associated (continued) inoperable equipment (or on variables outside the specified limits), as permitted by SR 3.0.1. Therefore, utilizing LCO 3.0.4 is not a violation of SR 3.0.1 or SR 3.0.4 for any Surveillances that have not been performed on inoperable equipment. However, SRs must be met to ensure OPERABILITY prior to declaring the associated equipment OPERABLE (or variable within limits) and restoring compliance with the affected LCO.

LCO 3.0.5 LCO 3.0.5 establishes the allowance for restoring equipment to service under administrative controls when it has been removed from service or declared inoperable to comply with ACTIONS. The sole purpose of this Specification is to provide an exception to LCO 3.0.2 (e.g., to not comply with the applicable Required Action(s)) to allow the performance of SRs to demonstrate:

a. The OPERABILITY of the equipment being returned to service; or

b. The OPERABILITY of other equipment.

(continued)

CLINTON B 3.0-6b Revision No. 10-3

SR Applicability B 3.0 BASES SR 3.0.3 missed Surveillance should be treated as an emergent (continued) condition as discussed in the Regulatory Guide. The risk evaluation may use quantitative, qualitative, or blended methods. The degree of depth and rigor of the evaluation should be commensurate with the importance of the component.

Missed Surveillances for important components should be analyzed quantitatively. If the results of the risk evaluation determine the risk increase is significant, this evaluation should be used to determine the safest course of action. All missed Surveillances will be placed in the Clinton Power Station Corrective Action Program.

If a Surveillance is not completed within the allowed delay period, then the equipment is considered inoperable or the variable then is considered outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon expiration of the delay period. If a Surveillance is failed within the delay period, then the equipment is inoperable, or the variable is outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon the failure of the Surveillance.

Completion of the Surveillance within the delay period allowed by this Specification, or within the Completion Time of the ACTIONS, restores compliance with SR 3.0.1.

SR 3.0.4 SR 3.0.4 establishes the requirement that all applicable SRs must be met before entry into a MODE or other specified condition in the Applicability.

This Specification ensures that system and component OPERABILITY requirements and variable limits are met before entry into MODES or other specified conditions in the Applicability for which these systems and components ensure safe operation of the unit. The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or components to OPERABLE status before entering an associated MODE or other specified condition in the Applicability.

A provision is included to allow entry into a MODE or other specified condition in the Applicability when an LCO is not met due to Surveillance not being met in accordance with LCO 3.0.4.

(continued)

CLINTON B 3.0-14 Revision No. 10-3

SR Applicability B 3.0 BASES SR 3.0.4 However, in certain circumstances, failing to meet an SR (continued) will not result in SR 3.0.4 restricting a MODE change or other specified condition change. When a system, subsystem, division, component, device, or variable is inoperable or outside its specified limits, the associated SR(s) are not required to be performed, per SR 3.0.1, which states that surveillances do not have to be performed on inoperable equipment. When equipment is inoperable, SR 3.0.4 does not apply to the associated SR(s) since the requirement for the SR(s) to be performed is removed. Therefore, failing to perform the Surveillance(s) within the specified Frequency does not result in an SR 3.0.4 restriction to changing MODES or other specified conditions of the Applicability.

However, since the LCO is not met in this instance, LCO 3.0.4 will govern any restrictions that may (or may not) apply to MODE or other specified condition changes. SR 3.0.4 does not restrict changing MODES or other specified conditions of the Applicability when a Surveillance has not been performed within the specified Frequency, provided the requirement to declare the LCO not met has been delayed in accordance with SR 3.0.3.

The provisions of SR 3.0.4 shall not prevent entry into MODES or other specified conditions in the Applicability that are required to comply with ACTIONS. In addition, the provisions of SR 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that result from any unit shutdown. In this context, a unit shutdown is defined as a change in MODE or other specified condition in the Applicability associated with transitioning from MODE 1 to MODE 2 or 3, MODE 2 to MODE 3, and MODE 3 to MODE 4.

The precise requirements for performance of SRs are specified such that exceptions to SR 3.0.4 are not necessary. The specific time frames and conditions necessary for meeting the SRs are specified in the Frequency, in the Surveillance, or both. This allows performance of Surveillances when the prerequisite condition(s) specified in a Surveillance procedure require entry into the MODE or other specified condition in the Applicability of the associated LCO prior to the performance or completion of a Surveillance. A Surveillance that could not be performed until after entering the LCO's Applicability, would have its Frequency specified such that it is not "due" until the specific conditions needed are met. Alternately, the Surveillance may be stated in the form of a Note, as not required (to be met or performed) until a particular event, condition, or time has been reached. Further discussion of the specific formats of SRs' annotation is found in Section 1.4, Frequency.

CLINTON B 3.0-15 Revision No. 10-3

SLC System B 3.1.7 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.7 Standby Liquid Control (SLC) System BASES BACKGROUND The SLC System is designed to provide the capability of bringing the reactor, at any time in a fuel cycle, from full power and minimum control rod inventory (which is at the peak of the xenon transient) to a subcritical condition with the reactor in the most reactive xenon free state without taking credit for control rod movement. The SLC System satisfies the requirements of 10 CFR 50.62 (Ref. 1) on anticipated transient without scram (ATWS).

The SLC System is also used to maintain suppression pool pH at or above 7 following a loss of coolant accident (LOCA) involving significant fission product releases. Maintaining suppression pool pH levels at or above 7 following an accident ensures that iodine will be retained in the suppression pool water (Ref. 8).

The SLC System consists of a boron solution storage tank, two positive displacement pumps, two explosive valves, which are provided in parallel for redundancy, and associated piping and valves used to transfer borated water from the storage tank to the reactor pressure vessel (RPV). The preferred flow path of the boron neutron absorber solution to the reactor vessel is by the High Pressure Core Spray (HPCS) System sparger. The SLC piping is connected to the HPCS System just downstream of the HPCS manual injection isolation valve. An alternate flow path to the reactor vessel is provided by the SLC sparger near the bottom of the core shroud. This flow path is normally locked out of service by the SLC manual injection valve.

APPLICABLE The SLC System is manually initiated from the main control SAFETY ANALYSES room, as directed by the emergency operating procedures, if the operator believes the reactor cannot be shut down, or kept shut down, with the control rods. The SLC System is used in the event that not enough control rods can be inserted to accomplish shutdown and cooldown in the normal manner. The SLC System injects borated water into the reactor core to compensate for all of the various reactivity effects that could occur during plant operation. To meet this objective, it is necessary to inject a quantity of boron that produces a concentration equivalent to at least 1000 ppm of natural boron in the reactor core at 68 0 F. This is accomplished by the use of enriched boron (Ž 30 atom%

boron 10). To allow for potential leakage and imperfect mixing in the reactor system, an additional amount of boron equal to 25% of the amount cited above is added (Ref. 2).

The concentration versus volume limits in Figure 3.1.7-1 are calculated such that the required concentration is achieved accounting for dilution in the RPV with normal water level (continued)

CLINTON B 3.1-38 Revision No. 10-5

SLC System B 3.1.7 BASES APPLICABLE and including the water volume in the residual heat removal SAFETY ANALYSES shutdown cooling piping and in the recirculation loop (continued) piping. This quantity of borated solution is the amount that is above the storage tank level instrument zero. (The instrument zero is based on ensuring sufficient net positive suction head and includes additional margin to preclude air entrainment in the pump suction piping due to vortexing during two pump operation.)

Following a LOCA, offsite doses from the accident will remain within 10 CFR 50.67, "Accident Source Term," limits (Ref. 9) provided sufficient iodine activity is retained in the suppression pool. Credit for iodine deposition in the suppression pool is allowed (Ref. 8) as long as suppression pool pH is maintained at or above 7. Alternative Source Term analyses credit the use of the SLC System for maintaining the pH of the suppression pool at or above 7.

The SLC System satisfies the requirements of the NRC Policy Statement because operating experience and probabilistic risk assessment have generally shown it to be important to public health and safety.

LCO The OPERABILITY of the SLC System provides backup capability for reactivity control, independent of normal reactivity control provisions provided by the control rods. The OPERABILITY of the SLC System is based on the conditions of the borated solution in the storage tank and the availability of a flow path to the RPV, including the OPERABILITY of the pumps and valves. Two SLC subsystems are required to be OPERABLE, each containing an OPERABLE pump, an explosive valve and associated piping, valves, and instruments and controls to ensure an OPERABLE flow path.

APPLICABILITY In MODES 1 and 2, shutdown capability is required. In MODES 3 and 4, control rods are not able to be withdrawn since the reactor mode switch is in Shutdown and a control rod block is applied. This provides adequate controls to ensure the reactor remains subcritical. In MODE 5, only a single control rod can be withdrawn from a core cell containing fuel assemblies. Demonstration of adequate SDM (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)") ensures that the reactor will not become critical. Therefore, the SLC System is not required to be OPERABLE during these conditions, when only a single control rod can be withdrawn.

In MODES 1, 2, and 3, the SLC System must be OPERABLE to ensure that offsite doses remain within 10 CFR 50.67 (Ref.

9) limits following a LOCA involving significant fission product releases. The SLC System is used to maintain (continued)

CLINTON B 3.1-39 Revision No. 10-5

e SLC System B 3.1.7 BASES APPLICABLE suppression pool pH at or above 7 following a LOCA to SAFETY ANALYSIS ensure that iodine will be retained in the suppression (continued) pool water (Ref. 8).

ACTIONS A.1 If one SLC subsystem is inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this condition, the remaining OPERABLE subsystem is adequate to perform the shutdown function. However, the overall reliability is reduced because a single failure in the (continued)

CLINTON B 3.1-39a Revision No. 10-5

This page intentionally blank.

CLINTON B 3.1-39b Revision No. 10-5

SLC System B 3.1.7 BASES ACTIONS A.1 (continued) remaining OPERABLE subsystem could result in reduced SLC System shutdown capability. The 7 day Completion Time is based on the availability of an OPERABLE subsystem capable of performing the intended SLC System function and the low probability of a Design Basis Accident (DBA) or severe transient occurring concurrent with the failure of the Control Rod Drive System to shut down the plant.

B.1 If both SLC subsystems are inoperable, at least one subsystem must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . The allowed Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months is considered acceptable, given the low probability of a DBA or transient occurring concurrent with the failure of the control rods to shut down the reactor.

C.1 and C.2 If any Required Action and associated Completion Time is not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.1.7.1, SR 3.1.7.2, and SR 3.1.7.3 REQUIREMENTS SR 3.1.7.1 through SR 3.1.7.3 are 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Surveillances, verifying certain characteristics of the SLC System (i.e.,

the volume and temperature of the borated solution in the storage tank, and temperature of the pump suction piping),

thereby ensuring the SLC System OPERABILITY without disturbing normal plant operation. These Surveillances ensure the proper borated solution and temperature, including the temperature of the pump suction piping, are maintained. Maintaining a minimum specified borated solution temperature is important in ensuring that the boron remains in solution and does not precipitate out in the (continued)

CLINTON B 3.1-40 Revision No. 10-5

SLC System B 3.1.7 BASES SURVEILLANCE SR 3.1.7.8 and SR 3.1.7.9 REQUIREMENTS These Surveillances ensure that there is a functioning flow path from the boron solution storage tank to the RPV, including the firing of an explosive valve. The replacement charge for the explosive valve shall be from the same manufactured batch as the one fired or from another batch that has been certified by having one of that batch successfully fired. The pump and explosive valve tested should be alternated such that both complete flow paths are tested every 48 months, at alternating 24 month intervals.

The Surveillance may be performed in separate steps to prevent injecting boron into the RPV. An acceptable method for verifying flow from the pump to the RPV is to pump demineralized water from a test tank through one SLC subsystem and into the RPV. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown these components usually pass the Surveillance test; therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

Demonstrating that all piping between the boron solution storage tank and the suction inlet to the injection pumps is unblocked ensures that there is a functioning flow path for injecting the sodium pentaborate solution. An acceptable method for verifying that the suction piping is unblocked is to pump from the storage tank to the test tank. Following this test, the piping will be drained and flushed with demineralized water. The 24 month Frequency is acceptable since there is a low probability that the subject piping will be blocked due to precipitation of the boron from solution in the piping. This is especially true in light of the daily temperature verification of this piping required by SR 3.1.7.3. However, if, in performing SR 3.1.7.3, it is determined that the temperature of this piping has fallen below the specified minimum, SR 3.1.7.9 must be performed once within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after the piping temperature is restored to > 70 0 F.

(continued)

CLINTON B 3.1-43 Revision No. 10-7

SLC System B 3.1.7 BASES REFERENCES 1. 10 CFR 50.62.

2. USAR, Section 9.3.5.3.

3. Calculation IP-0-0012.

4. Calculation IP-0-0013.

5. Calculation IP-0-0014.

6. Calculation IP-0-0015.

7. Calculation IP-0-0016.

8. NUREG-1465, 'Accident Source Terms for Light-Water Nuclear Power Plants, Final Report," February 1, 1995.

9. 10 CFR 50.67, "Accident Source Terms."

CLINTON B 3.1-43a Revision No. 10-5

SDV Vent and Drain Valves B 3.1.8 BASES APPLICABLE allow continuous drainage of the SDV during normal plant SAFETY ANALYSES operation to ensure the SDV has sufficient capacity to (continued) contain the reactor coolant discharge during a full core scram. To automatically ensure this capacity, a reactor scram (LCO 3.3.1.1, "Reactor Protection System (RPS)

Instrumentation") is initiated if the SDV water level exceeds a specified setpoint. The setpoint is chosen such that all control rods are inserted before the SDV has insufficient volume to accept a full scram.

SDV vent and drain valves satisfy Criterion 3 of the NRC Policy Statement.

LCO The OPERABILITY of all SDV vent and drain valves ensures that, during a scram, the SDV vent and drain valves will close to contain reactor water discharged to the SDV piping.

Since the vent and drain lines are provided with two valves in series, the single failure of one valve in the open position will not impair the isolation function of the system. Additionally, the valves are required to be open to ensure that a path is available for the SDV piping to drain freely at other times.

APPLICABILITY In MODES 1 and 2, scram may be required, and therefore, the SDV vent and drain valves must be OPERABLE. In MODES 3 and 4, control rods are not able to be withdrawn since the reactor mode switch is in Shutdown and a control rod block is applied. This provides adequate controls to ensure that only a single control rod can be withdrawn. Also, during MODE 5, only a single control rod can be withdrawn from a core cell containing fuel assemblies. Therefore, the SDV vent and drain valves are not required to be OPERABLE in these MODES since the reactor is subcritical and only one rod may be withdrawn and subject to scram.

ACTIONS The ACTIONS table is modified by Note 1 indicating that a I separate Condition entry is allowed for each SDV vent and drain line. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable SDV line. Complying with the Required Actions may allow for continued operation, and subsequent inoperable SDV lines are governed by subsequent Condition entry and application of associated Required Actions.

(continued)

CLINTON B 3.1-45 Revision No. 10-1

SDV Vent and Drain Valves B 3.1.8 BASES ACTIONS When a line is isolated, the potential for an inadvertent (continued) scram due to high SDV level is increased. During these periods, the line may be unisolated under administrative control. This allows any accumulated water in the line to be drained, to preclude a reactor scram on SDV high level.

This is acceptable, since the administrative controls ensure the valve can be closed quickly, by a dedicated operator, if a scram occurs with the valve open.

A.1 When one SDV vent or drain valve is inoperable in one or more lines, the associated line must be isolated to contain the reactor coolant during a scram. The 7 day Completion Time is reasonable, given the level of redundancy in the lines and the low probability of a scram occurring during the time the valve(s) are inoperable and the line is not isolated. The SDV is still isolable since the redundant valve in the affected line is OPERABLE. Since the SDV is still isolable, the affected SDV line may be opened. This allows any accumulated water in the line to be drained, to preclude a reactor scram on SDV high level. During these periods, the single failure criterion may not be preserved, and a higher risk exists to allow reactor water out of the primary system during a scram.

B.1 If both valves in a line are inoperable, the line must be isolated to contain the reactor coolant during a scram.

The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time to isolate the line is based on the low probability of a scram occurring while the line is not isolated and unlikelihood of significant CRD seal leakage.

C.1 If any Required Action and associated Completion Time is not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

(continued)

CLINTON B 3.1-46 Revision No. 10-1

SDV Vent and Drain Valves B 3.1.8 BASES (continued)

SURVEILLANCE SR 3.1.8.1 REQUIREMENTS During normal operation, the SDV vent and drain valves should be in the open position (except when performing SR 3.1.8.2) to allow for drainage of the SDV piping.

Verifying that each valve is in the open position ensures that the SDV vent and drain valves will perform their intended function during normal operation. This SR does not require any testing or valve manipulation; rather, it involves verification that the valves are in the correct position. The 31 day Frequency is based on engineering judgment and is consistent with the procedural controls governing valve operation, which ensure correct valve positions. Improper valve position (closed) would not affect the isolation function.

SR 3.1.8.2 During a scram, the SDV vent and drain valves should close to contain the reactor water discharged to the SDV piping.

Cycling each valve through its complete range of motion (closed and open) ensures that the valve will function properly during a scram. The 92 day Frequency is based on operating experience and takes into account the level of redundancy in the system design.

SR 3.1.8.3 SR 3.1.8.3 is an integrated test of the SDV vent and drain valves to verify total system performance. After receipt of a simulated or actual scram signal, the closure of the SDV vent and drain valves is verified. The closure time of 30 seconds after a receipt of a scram signal is based on the bounding leakage case evaluated in the accident analysis.

Similarly, after receipt of a simulated or actual scram reset signal, the opening of the SDV vent and drain valves is verified. The LOGIC SYSTEM FUNCTIONAL TEST in LCO 3.3.1.1 and the scram time testing of control rods in LCO 3.1.3, "Control Rod OPERABILITY," overlap this Surveillance to provide complete testing of the assumed safety function. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with (continued)

CLINTON B 3.1-47 Revision No. 10-7

SDV Vent and Drain Valves B 3.1.8 BASES SURVEILLANCE SR 3.1.8.3 (continued)

REQUIREMENTS the reactor at power. Operating experience has shown these components usually pass the Surveillance; therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

With regard to SDV vent and drain valve closing time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 4).

REFERENCES 1. USAR, Section 4.6.1.1.2.4.2.5.

2. 10 CFR 100.

3. NUREG-0803, "Generic Safety Evaluation Report Regarding Integrity of BWR Scram System Piping,"

August 1981.

4. Calculation IP-0-0017.

CLINTON B 3.1-48 Revision No. 10-7

RPS Instrumentation B 3.3.1.1 B 3.3 INSTRUMENTATION B 3.3.1.1 Reactor Protection System (RPS) Instrumentation BASES BACKGROUND The RPS initiates a reactor scram when one or more monitored parameters exceed their specified limit, to preserve the integrity of the fuel cladding and the Reactor Coolant System (RCS), and minimize the energy that must be absorbed following a loss of coolant accident (LOCA). This can be accomplished either automatically or manually.

The protection and monitoring functions of the RPS have been designed to ensure safe operation of the reactor. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the RPS, as well as LCOs on other reactor system parameters, and equipment performance. The LSSS are defined in this Specification as the Allowable Values except Function 6 in Technical Specification Table 3.3.1.1-1 (the Nominal Trip Setpoint defines the LSSS for this Function), which, in conjunction with the LCOs, establish the threshold for protective system action to prevent exceeding acceptable limits, including Safety Limits (SLs), during Design Basis Accidents (DBAs).

The RPS, as described in USAR, Section 7.2 (Ref. 1),

includes sensors, trip modules, bypass circuits, and switches that are necessary to cause initiation of a reactor scram. Functional diversity is provided by monitoring a wide range of dependent and independent parameters. The input parameters to the scram logic are from instrumentation that monitors reactor vessel water level; reactor vessel pressure; neutron flux; main steam line isolation valve position; turbine control valve (TCV) fast closure, trip oil pressure; turbine stop valve (TSV) closure; drywell pressure; and scram discharge volume (SDV) water level; as well as reactor mode switch in shutdown position and manual scram signals. There are at least four redundant sensor input signals from each of these parameters (with the exception of the reactor mode switch in shutdown scram signal). Most channels include electronic equipment (e.g.,

analog trip modules (ATMs)) that compares measured input signals with pre-established setpoints. When a setpoint is exceeded, the ATM output changes state, providing an RPS trip signal to the trip logic.

(continued)

CLINTON B 3.3-1 Revision No. 10-6

0 RPS Instrumentation B 3.3.1.1 BASES BACKGROUND The RPS is comprised of four independent trip logic (continued) divisions (1, 2, 3, and 4) as described in Reference 1.

Each RPS input for a variable is independently monitored by one instrument channel in each of the four divisions. Each instrument channel combines the four RPS Function inputs for that variable in a two-out-of-four logic. Each instrument channel in turn provides an input to all four RPS trip logic divisions. The four RPS trip logic divisions are also combined in a two-out-of-four arrangement. Each RPS trip logic division provides four output signals to load drivers which de-energize the scram pilot valve solenoids. Each trip logic division can be reset by use of a reset switch.

If a logic division trips or a full scram occurs (two-out-of-four trip logic divisions trip), a solid state time delay prevents reset of the trip logic division for 10 seconds after the signal is received. This 10 second delay on reset ensures that the scram function will be completed.

Two scram pilot valves are located in the hydraulic control unit (HCU) for each control rod drive (CRD). Each scram pilot valve is solenoid operated, with the solenoids normally energized. The scram pilot valves control the air supply to the scram inlet and outlet valves for the associated CRD. When either scram pilot valve solenoid is energized, air pressure holds the scram valves closed and, therefore, both scram pilot valve solenoids must be de-energized to cause a control rod to scram. The scram valves control the supply and discharge paths for the CRD water during a scram. One of the scram pilot valve solenoids for each CRD is controlled by two trip logic divisions, and the other solenoid is controlled by the other two trip logic divisions. De-energizing both solenoids results in the air bleeding off, scram valves opening, and control rod scram.

The backup scram valves, which energize on a scram signal to depressurize the scram air header, are also controlled by the RPS. Additionally, the RPS System controls the SDV vent and drain valves such that when a scram signal is generated, the SDV vent and drain valves close to isolate the SDV.

APPLICABLE The actions of the RPS are assumed in the safety analyses SAFETY ANALYSES, of References 2, 3, and 4. The RPS initiates a reactor LCO, and scram when monitored parameter values exceed the trip APPLICABILITY setpoints specified by the setpoint methodology I (continued)

CLINTON B 3.3-2 Revision No. 10-6

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE to preserve the integrity of the fuel cladding, the reactor SAFETY ANALYSES, coolant pressure boundary (RCPB), and the containment by LCO, and minimizing the energy that must be absorbed following a APPLICABILITY LOCA.

(continued)

RPS instrumentation satisfies Criterion 3 of the NRC Policy Statement. Functions not specifically credited in the accident analysis are retained for the RPS as required by the NRC approved licensing basis.

The OPERABILITY of the RPS is dependent on the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.1.1-1. Each Function must have four OPERABLE channels, with their setpoints within the specified Allowable Value, where appropriate. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. Each channel must also respond within its assumed response time.

Allowable Values are specified for each RPS Function specified in the Table. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the actual setpoints do not exceed the Allowable Value between successive CHANNEL CALIBRATIONS. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value.

Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., analog trip module) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values and trip setpoints are derived from the analytic limits, accounting for applicable process errors, severe environment errors, instrument errors (e.g., drift),

and calibration errors in accordance with the setpoint methodology documented in the Operational Requirements Manual (ORM). The trip setpoints derived in this manner provide (continued)

CLINTON B 3.3-3 Revision No. 10-6

RPS Instrumentation B 3.3.1.1 BASES APPLICABLE l.a. Intermediate Range Monitor (IRM) Neutron Flux-High SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY damage resulting from abnormal operating transients in the intermediate power range. In this power range, the most significant source of reactivity change is due to control rod withdrawal. The IRM provides diverse protection for the rod pattern controller (RPC), which monitors and controls the movement of control rods at low power. The RPC prevents the withdrawal of an out of sequence control rod during startup that could result in an unacceptable neutron flux excursion (Ref. 5). The IRM provides mitigation of the neutron flux excursion. To demonstrate the capability of the IRM System to mitigate control rod withdrawal events, generic analyses have been performed (Ref. 6) to evaluate the consequences of control rod withdrawal events during startup that are mitigated only by the IRM. This analysis demonstrates that the IRMs provide protection against local control rod withdrawal errors which results in peak fuel energy depositions below the 170 cal/gm fuel failure threshold criterion.

The IRMs are also capable of limiting other reactivity excursions during startup, such as cold water injection events, although no credit is specifically assumed.

The IRM System is divided into four groups of IRM channels, with two IRM channels inputting to each trip logic division.

Per the analysis of Reference 6, six IRM channels, including at least one IRM channel per trip logic division, are required for IRM OPERABILITY. The RPS logic ensures that no single instrument failure will preclude a scram from this Function on a valid signal. This trip is active in each of the 10 ranges of the IRM, which must be selected by the operator to maintain the neutron flux within the monitored level of an IRM range.

The analysis of Reference 6 has adequate conservatism to permit an IRM Allowable Value of 122 divisions of a 125 division scale.

The Intermediate Range Monitor Neutron Flux-High Function must be OPERABLE during MODE 2 when control rods may be withdrawn and the potential for criticality exists. In MODE 5, when a cell with fuel has its control rod withdrawn, the IRMs provide monitoring for and protection against unexpected reactivity excursions. In MODE 1, the APRM (continued)

CLINTON B 3.3-5 Revision No. 10-8

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.9 and SR 3.3.1.1.12 (continued)

REQUIREMENTS The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown that these components usually pass the Surveillance.

SR 3.3.1.1.10 The calibration of analog trip modules provides a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.1.1-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.

The Frequency of 92 days for SR 3.3.1.1.10 is based on the reliability analysis of Reference 9.

SR 3.3.1.1.11 and SR 3.3.1.1.13 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The SR 3.3.1.1.13 calibration for selected Functions is modified by a Note as identified in Table 3.3.1.1-1. This Note, which applies only to those Functions identified in Table 3.3.1.1-1, is divided into three parts. Part 1 of the Note requires evaluation of instrument performance for the condition where the as-found setting for these instrument channels is outside its As-Found Tolerance (AFT) but conservative with respect to the Allowable Value.

Evaluation of instrument performance will verify that the instrument will continue to behave in accordance with design-basis assumptions. The purpose of the assessment is to ensure confidence in the instrument performance prior to returning the instrument to service. Initial evaluation will be performed by the technician performing the surveillance who will evaluate the instrument's ability to (continued)

CLINTON B 3.3-27 Revision No. 10-7

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.11 and SR 3.3.1.1.13 (continued)

REQUIREMENTS maintain a stable setpoint within the As-Left Tolerance (ALT). The technician's evaluation will be reviewed by on-shift operations personnel during the approval of the surveillance data. Subsequent to returning the instrument to service, the deviation is entered into the Corrective Action Program. In accordance with procedures, entry into the Corrective Action Program will require review and documentation of the condition for operability by on-shift operations personnel. Additional evaluation and potential corrective actions as necessary will ensure that any as-found setting found outside the AFT is evaluated for long-term operability trends. If the as-found channel setpoint is not conservative with respect to the Allowable Value, the channel shall be declared inoperable. Part 2 of the Note requires that the instrument channel setpoint shall be reset to within the ALT of the Actual Trip Setpoint (ATSP). The ATSP is equivalent to or more conservative than the Nominal Trip Setpoint (NTSP). The NTSP is the limiting value of the sensed process variable at which a trip may be set in accordance with the methodology documented in the ORM.

Therefore, the NTSP is equivalent to the Limiting Safety System Setting (LSSS) required by 10 CFR 50.36, "Technical specifications." The Actual Trip Setpoint is also calculated in accordance with the plant-specific setpoint methodology as documented in the CPS ORM and may include additional margin. The ATSP will ensure that sufficient margin to the safety and/or analytical limit is maintained.

If the as-left instrument channel setpoint cannot be returned to within the ALT of the Actual Trip Setpoint, then the channel shall be declared inoperable. Part 3 of the Note indicates that the Nominal Trip Setpoint and the methodology used to determine the Nominal Trip Setpoint, the As-Found Tolerance and the As-Left Tolerance bands are specified in the ORM.

Note 1 states that neutron detectors are excluded from CHANNEL CALIBRATION because of the difficulty of simulating a meaningful signal. Changes in neutron detector sensitivity are compensated for by performing the 7 day calorimetric calibration (SR 3.3.1.1.2) and the 1000 MWD/T LPRM calibration against the TIPs (SR 3.3.1.1.8). A second Note is provided that requires the APRM and the IRM SRs to be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of entering MODE 2 from MODE 1.

(continued)

CLINTON B 3.3-27a Revision No. 10-6

This page intentionally left blank.

CLINTON B 3.3-27b Revision No. 10-6

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.11 and SR 3.3.1.1.13 (continued)

REQUIREMENTS Testing of the MODE 2 APRM and IRM Functions cannot be performed in MODE 1 without utilizing jumpers, lifted leads, or movable links. This Note allows entry into MODE 2 from MODE 1 if the associated Frequency is not met per SR 3.0.2.

Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the SR. The Frequency of SR 3.3.1.1.11 and SR 3.3.1.1.13 is based upon the assumption of the magnitude of equipment drift in the setpoint analysis.

SR 3.3.1.1.14 The Average Power Range Monitor Flow Biased Simulated Thermal Power-High Function uses an electronic filter circuit to generate a signal proportional to the core THERMAL POWER from the APRM neutron flux signal. This filter circuit is representative of the fuel heat transfer dynamics that produce the relationship between the neutron flux and the core THERMAL POWER. The filter time constant is specified in the COLR and must be verified to ensure that the channel is accurately reflecting the desired parameter.

The Frequency of 24 months is based on engineering judgment and reliability of the components.

With regard to filter time constant values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 11).

SR 3.3.1.1.15 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. The functional testing of control rods, in LCO 3.1.3, "Control Rod OPERABILITY," and SDV vent and drain valves, in LCO 3.1.8, "Scram Discharge Volume (SDV) Vent and Drain Valves," overlaps this Surveillance to provide complete testing of the assumed safety function.

(continued)

CLINTON B 3.3-28 Revision No. 10-7

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.15 (continued)

REQUIREMENTS The Self Test System may be utilized to perform this testing for those components that it is designed to monitor. Those portions of the solid-state logic not monitored by the Self Test System may be tested at the frequency recommended by the manufacturer, rather than at the specified 24-month Frequency. The frequencies recommended by the manufacturer are based on mean time between failure analysis for the components in the associated circuits.

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the surveillance were performed with the reactor at power.

Operating experience has shown that these components usually pass the Surveillance.

SR 3.3.1.1.16 This SR ensures that scrams initiated from the Turbine Stop Valve Closure and Turbine Control Valve Fast Closure, Trip Oil Pressure-Low Functions will not be inadvertently bypassed when THERMAL POWER is > 33.3% RTP. This involves calibration of the bypass channels. Adequate margins for the instrument setpoint methodology are incorporated into the actual setpoint.

If any bypass channel setpoint is nonconservative such that the Functions are bypassed at > 33.3% RTP (e.g., due to open main steam line drain(s), main turbine bypass valve(s) or other reasons), then the affected Turbine Stop Valve Closure and Turbine Control Valve Fast Closure, Trip Oil Pressure-Low Functions are considered inoperable.

Alternatively, the bypass channel can be placed in the conservative condition (nonbypass). If placed in the nonbypass condition, this SR is met and the channel is considered OPERABLE.

The Frequency of 24 months is based on engineering judgment and reliability of the components.

(continued)

CLINTON B 3.3-29 Revision No. 10-7

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.17 REQUIREMENTS (continued) This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis. The RPS RESPONSE TIME acceptance criteria are included in plant Surveillance procedures.

As noted, neutron detectors are excluded from RPS RESPONSE TIME testing because the principles of detector operation virtually ensure an instantaneous response time. In addition, for Functions 3, 4, and 5, the associated sensors are not required to be response time tested. For these Functions, response time testing for the remaining channel components, including the ATMs, is required. This allowance is supported by Reference 10. RPS RESPONSE TIME tests are conducted on a 24 month STAGGERED TEST BASIS. Note 3 of SR 3.3.1.1.17 requires STAGGERED TEST BASIS Frequency for each Function to be determined separately based on the four channels as specified in Table 3.3.1.1-1. This Frequency is based on the logic interrelationships of the various channels required to produce an RPS scram signal.

Therefore, staggered testing results in response time verification of these devices every 24 months. This Frequency is consistent with the typical industry refueling cycle and is based upon plant operating experience, which shows that random failures of instrumentation components causing serious time degradation, but not channel failure, are infrequent.

With regard to RPS RESPONSE TIME values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 12).

(continued)

CLINTON B 3.3-30 Revision No. 10-7

SRM Instrumentation B 3.3.1.2 BASES SURVEILLANCE SR 3.3.1.2.5 (continued)

REQUIREMENTS The Note to the Surveillance allows the Surveillance to be delayed until entry into the specified condition of the Applicability. The SR must be performed in MODE 2 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of entering MODE 2 with IRMs on Range 2 or below.

The allowance to enter the Applicability with the 31 day Frequency not met is reasonable, based on the limited time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed after entering the Applicability and the inability to perform the Surveillance while at higher power levels. Although the Surveillance could be performed while on IRM Range 3, the plant would not be expected to maintain steady state operation at this power level. In this event, the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is reasonable, based on the SRMs being otherwise verified to be OPERABLE (i.e., satisfactorily performing the CHANNEL CHECK) and the time required to perform the Surveillances.

SR 3.3.1.2.6 Performance of a CHANNEL CALIBRATION verifies the performance of the SRM detectors and associated circuitry.

The Frequency considers the plant conditions required to perform the test, the ease of performing the test, and the likelihood of a change in the system or component status.

The neutron detectors are excluded from the CHANNEL CALIBRATION because they cannot readily be adjusted. The detectors are fission chambers that are designed to have a relatively constant sensitivity over the range, and with an accuracy specified for a fixed useful life.

The Note to the Surveillance allows the Surveillance to be delayed until entry into the specified condition of the Applicability. The SR must be performed in MODE 2 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of entering MODE 2 with IRMs on Range 2 or below. The allowance to enter the Applicability with the 24 month Frequency not met is reasonable, based on the limited time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed after entering the Applicability and the inability to perform the Surveillance while at higher power levels. Although the Surveillance could be performed while on IRM Range 3, the plant would not be expected to maintain steady state operation at this power level. In this event, the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is reasonable, based on the SRMs being otherwise verified to be OPERABLE (i.e., satisfactorily (continued CLINTON B 3.3-38 Revision No. 10-7

Control Rod Block Instrumentation B 3.3.2.1 BASES SURVEILLANCE SR 3.3.2.1.8 (continued)

REQUIREMENTS the shutdown position, since testing of this interlock with the reactor mode switch in any other position cannot be performed without using jumpers, lifted leads, or movable limits. This allows entry into MODES 3 and 4 if the 24 month Frequency is not met per SR 3.0.2. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months allowance is based on operating experience and in consideration of providing a reasonable time in which to complete the SRs.

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown these components usually pass the Surveillance.

SR 3.3.2.1.9 LCO 3.1.3 and LCO 3.1.6 may require individual control rods to be bypassed in RACS to allow insertion of an inoperable control rod or correction of a control rod pattern not in compliance with BPWS. With the control rods bypassed in the RACS, the RPC will not control the movement of these bypassed control rods. Individual control rods may also be required to be bypassed to allow continuous withdrawal for determining the location of leaking fuel assemblies or adjustment of control rod speed. To ensure the proper bypassing and movement of those affected control rods, a second licensed operator or other qualified member of the technical staff must verify the bypassing and movement of these control rods is in conformance with applicable analyses. Compliance with this SR allows the RPC and RWL to be OPERABLE with these control rods bypassed.

REFERENCES 1. USAR, Section 7.6.1.7.

2. USAR, Section 15.4.2.

3. NEDE-24011-P-A, "General Electric Standard Application for Reload Fuel" (latest approved revision).

(continued)

CLINTON B 3.3-48 Revision No. 10-7

PAM Instrumentation B 3.3.3.1 BASES LCO 6. Drywell Area Radiation (continued)

Drywell area radiation (high range) is a Category I variable provided to monitor for the potential of significant radiation releases and to provide release assessment for use by operators in determining the need to invoke site emergency plans. Two high range radiation detectors are provided to monitor the drywell area gross gamma radiation levels. These detectors monitor the range 1 to 10E7 R/hr and provide inputs to monitors in the main control room.

The monitors are the primary indication used by the operator during an accident. Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

7. Primary Containment Isolation Valve (PCIV) Position PCIV position is provided for verification of containment integrity. In the case of PCIV position, the important information is the status of the containment penetration.

The LCO requires one channel of valve position indication in the control room to be OPERABLE for each automatic PCIV in a containment penetration flow path; i.e., two total channels of PCIV position indication for a penetration flow path with two automatic valves. For containment penetrations with only one automatic PCIV having control room indication, Note (b) requires a single channel of valve position indication to be OPERABLE. This is sufficient to verify redundantly the isolation status of each isolable penetration via indicated status of the automatic valve and, as applicable, prior knowledge of passive valve or system boundary status.

If a penetration is isolated by at least one closed and de-activated automatic valve, closed manual valve, blind flange, or check valve with flow through the valve secured, position indication for the PCIV(s) in the associated penetration flow path is not needed to determine status.

Therefore, the position indication for valves in an isolated penetration is not required to be OPERABLE.

8. (Deleted)

(continued)

CLINTON B 3.3-53 Revision No. 10-2

PAM Instrumentation B 3.3.3.1 BASES LCO 9. Primary Containment Pressure Primary containment pressure is a Category I variable provided to verify RCS and containment integrity and to verify the effectiveness of ECCS actions taken to prevent containment breach. Four wide range primary containment pressure signals are transmitted from separate pressure transmitters and are continuously recorded and displayed on four control room recorders. Two of these instruments monitor containment pressure from -5 psig to 10 psig (low range). The remaining two instruments monitor containment pressure from 5 psig to 45 psig (high range). These recorders are the primary indication used by the operator during an accident. Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

10. Suppression Pool Water Bulk Average Temperature Suppression pool water bulk average temperature is a Type A variable provided to detect a condition that could potentially lead to containment breach, and to verify the effectiveness of ECCS actions taken to prevent containment breach. The suppression pool water temperature instrumentation allows operators to detect trends in suppression pool water temperature in sufficient time to take action to prevent steam quenching vibrations in the suppression pool. Eight temperature sensors are arranged in two channels (i.e., divisions), located such that there is one sensor from each channel (division) within each quadrant of the suppression pool. These instruments provide the capability to monitor suppression pool water temperature (continued)

CLINTON B 3.3-54 Revision No. 10-2

PAM Instrumentation B 3.3.3.1 BASES LCO 10. Suppression Pool Water Bulk Average Temperature (continued) when pool water level is below the instruments addressed by the Operational Requirements Manual.

The outputs for the PAM sensors are recorded on two independent recorders in the control room. These recorders average the output from the four Division 1 sensors and the four Division 2 sensors. Both of these recorders must be OPERABLE to furnish two channels of PAM suppression pool water bulk average temperature. These recorders are the primary indication used by the operator during an accident.

Therefore, the PAM Specification deals specifically with this portion of the instrument channels(Reference 4).

APPLICABILITY The PAM instrumentation LCO is applicable in MODES 1 and 2.

These variables are related to the diagnosis and preplanned actions required to mitigate DBAs. The applicable DBAs are assumed to occur in MODES 1 and 2. In MODES 3, 4, and 5, plant conditions are such that the likelihood of an event that would require PAM instrumentation is extremely low; therefore, PAM instrumentation is not required to be OPERABLE in these MODES.

ACTIONS A Note has been provided to modify the ACTIONS related to I PAM instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for (continued)

CLINTON B 3.3-55 Revision No. 10-3

PAM Instrumentation B 3.3.3.1 BASES SURVEILLANCE SR 3.3.3.1.2 (Deleted)

REQUIREMENTS (continued) SR 3.3.3.1.3 For all Functions a CHANNEL CALIBRATION is performed every 24 months, or approximately at every refueling. CHANNEL I CALIBRATION is a complete check of the instrument loop including the sensor. The test verifies that the channel responds to the measured parameter with the necessary range and accuracy. The Frequency is based on operating experience and consistency with the typical industry refueling cycles.

The CHANNEL CALIBRATION of the Primary Containment and Drywell Area Radiation Functions consists of an electronic calibration of the channel, not including the detector, for range decades above 10 R per hour and a one point calibration check of the detector below 10 R per hour with an installed or portable gamma source.

REFERENCES 1. Regulatory Guide 1.97, "Instrumentation for Light-Water Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident," Revision 3, May 1983.

2. SSER 5, Section 7.5.3.1.

3. USAR, Table 7.1-13.

4. USAR Section 7.5.1.4.2.4.

CLINTON B 3.3-59 Revision No. 10-7

Remote Shutdown System B 3.3.3.2 BASES LCO The scope of this LCO does not include those controls (continued) associated with the steam condensing mode of the Residual Heat Removal System.

APPLICABILITY The Remote Shutdown System LCO is applicable in MODES 1 and 2. This is required so that the plant can be placed and maintained in MODE 3 for an extended period of time from a location other than the control room.

This LCO is not applicable in MODES 3, 4, and 5. In these MODES, the plant is already subcritical and in a condition of reduced Reactor Coolant System energy. Under these conditions, considerable time is available to restore necessary instrument control Functions if control room instruments or control becomes unavailable. Consequently, the TS does not require OPERABILITY in MODES 3, 4, and 5.

ACTIONS A Note has been provided to modify the ACTIONS related to Remote Shutdown System Functions. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable Remote Shutdown System Functions provide appropriate compensatory measures for separate Functions.

As such, a Note has been provided that allows separate Condition entry for each inoperable Remote Shutdown System Function.

(continued)

CLINTON B 3.3-62 Revision No. 10-3

Remote Shutdown System B 3.3.3.2 BASES SURVEILLANCE SR 3.3.3.2.1 (continued)

REQUIREMENTS outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. As specified in the Surveillance, a CHANNEL CHECK is only required for those channels that are normally energized.

The Frequency is based upon plant operating experience that demonstrates channel failure is rare.

SR 3.3.3.2.2 SR 3.3.3.2.2 verifies each required Remote Shutdown System transfer switch and control circuit performs the intended function. This verification is performed from the remote shutdown panel and locally, as appropriate. Operation of the equipment from the remote shutdown panel and the local control stations are not necessary. The Surveillance can be satisfied by performance of a continuity check. This will ensure that if the control room becomes inaccessible, the plant can be placed and maintained in MODE 3 from the remote shutdown panel and the local control stations. However, this Surveillance is not required to be performed only during a plant outage. Operating experience demonstrates that Remote Shutdown System control channels usually pass the Surveillance.

SR 3.3.3.2.3 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. The test verifies the channel responds to measured parameter values with the necessary range and accuracy.

The 24 month Frequency is based upon operating experience and is consistent with the typical industry refueling cycle.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 19.

2. Operational Requirements Manual, Attachment 1.

3. NUREG-0853, "Safety Evaluation Report Related to the Operation of Clinton Power Station, Unit No. 1,"

Supplement No. 6, July 1986, Section 7.4.3.1.

CLINTON B 3.3-64 Revision No. 10-7

EOC-RPT Instrumentation B 3.3.4.1 BASES SURVEILLANCE SR 3.3.4.1.3 REQUIREMENTS (continued) The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. The system functional test of the pump breakers is included as a part of this test, overlapping the LOGIC SYSTEM FUNCTIONAL TEST, to provide complete testing of the associated safety function. Therefore, if a breaker is incapable of operating, the associated instrument channels would also be inoperable.

The Self Test System may be utilized to perform this testing for those components that it is designed to monitor. Those portions of the solid-state logic not monitored by the Self Test System may be tested at the frequency recommended by the manufacturer, rather than at the specified 24-month Frequency. The frequencies recommended by the manufacturer are based on mean time between failure analysis for the components in the associated circuits.

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown these components usually pass the Surveillance test.

SR 3.3.4.1.4 This SR ensures that an EOC-RPT initiated from the TSV Closure and TCV Fast Closure, Trip Oil Pressure-Low Functions will not be inadvertently bypassed when THERMAL POWER is > 33.3% RTP. This involves calibration of the bypass channels. Adequate margins for the instrument setpoint methodologies are incorporated into the actual setpoint. If any bypass channel's setpoint is nonconservative such that the Functions are bypassed at

Ž 33.3% RTP (e.g., due to open main steam line drain(s),

main turbine bypass valve(s) or other reasons), the affected TSV Closure and TCV Fast Closure, Trip Oil Pressure-Low Functions are considered (continued)

CLINTON B 3 .3-73 Revision No. 10-7

EOC-RPT Instrumentation B 3.3.4.1 BASES SURVEILLANCE SR 3.3.4.1.4 (continued)

REQUIREMENTS inoperable. Alternatively, the bypass channel can be placed in the conservative condition (nonbypass). If placed in the nonbypass condition, this SR is met and the channel considered OPERABLE.

The Frequency of 24 months has shown that channel bypass failures between successive tests are rare.

SR 3.3.4.1.5 This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis. The EOC-RPT SYSTEM RESPONSE TIME acceptance criteria are included in applicable plant procedures and include an assumed RPT breaker interruption time of 80 milliseconds. This assumed RPT breaker interruption time is validated by the performance of periodic mechanical timing checks, contact wipe and erosion checks, and high potential tests on each breaker in accordance with plant procedures at least once per 24 months. The acceptance criterion for the RPT breaker mechanical timing check shall be 5 41 milliseconds (for trip coil TC2).

EOC-RPT SYSTEM RESPONSE TIME tests are conducted on an 24 month STAGGERED TEST BASIS. The Note requires STAGGERED TEST BASIS Frequency to be determined on a per Function basis. This is accomplished by testing all channels of one Function every 24 months on an alternating basis such that both Functions are tested every 48 months. This Frequency is based on the logic interrelationships of the various channels required to produce an EOC-RPT signal. Response times cannot be determined at power because operation of final actuated devices is required. Therefore, this Frequency is consistent with the typical industry refueling cycle and is based upon plant operating experience, which shows that random failures of instrumentation components that cause serious response time degradation, but not channel failure, are infrequent occurrences.

(continued)

CLINTON B 3.3-74 Revision No. 10-7

ATWS-RPT Instrumentation B 3.3.4.2 BASES SURVEILLANCE SR 3.3.4.2.5 REQUIREMENTS (continued) The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. The system functional test of the pump breakers, included as part of this Surveillance, overlaps the LOGIC SYSTEM FUNCTIONAL TEST to provide complete testing of the assumed safety function. Therefore, if a breaker is incapable of operating, the associated instrument channel(s) would be inoperable.

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant l

outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown that these components usually l pass the Surveillance.

REFERENCES 1. USAR, Section 7.7.1.25.2 CLINTON B 3.3-84 Revision No. 10-7

ECCS Instrumentation B 3.3.5.1 B 3.3 INSTRUMENTATION B 3.3.5.1 Emergency Core Cooling System (ECCS) Instrumentation BASES BACKGROUND The purpose of the ECCS instrumentation is to initiate appropriate responses from the systems to ensure that fuel is adequately cooled in the event of a design basis accident or transient. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the ECCS instrumentation, as well as LCOs on other reactor system parameters, and equipment performance.

The LSSS are defined in this Specification as the Allowable Values, except Functions l.a, l.d, 2.a, 2.d, 3.a, 3.c, 3.d, 3.e, 4.a, 4.e, 4.f, 5.a, and 5.e in Technical Specification Table 3.3.5.1-1 (the Nominal Trip Setpoint defines the LSSS for these Functions), which, in conjunction with the LCOs, establish the threshold for protective system action to prevent exceeding acceptable limits, including Safety Limits (SLs), during Design Basis Accidents (DBAs) and Anticipated Operational Occurrences (AOOs).

For most A00s and DBAs, a wide range of dependent and independent parameters are monitored.

The ECCS instrumentation actuates low pressure core spray (LPCS), low pressure coolant injection (LPCI), high pressure core spray (HPCS), Automatic Depressurization System (ADS),

and the diesel generators (DGs). The equipment involved with each of these systems is described in the Bases for LCO 3.5.1, "ECCS-Operating," and LCO 3.8.1, "AC Sources-Operating." In addition, the ECCS instrumentation that actuates HPCS also actuates the Division 3 Shutdown Service Water (SX) subsystem, including automatic start of the Division 3 SX pump and automatic actuation of the associated subsystem isolation valves. The equipment involved with this subsystem is described in the Bases for LCO 3.7.2, "Division 3 Shutdown Service Water (SX)

Subsystem."

Low Pressure Core Spray System The LPCS System may be initiated by either automatic or manual means. Automatic initiation occurs for conditions of Reactor Vessel Water Level-Low Low Low, Level 1 or Drywell Pressure-High. Each of these diverse variables is monitored by two redundant transmitters, which are, in turn, connected to two analog trip modules (ATMs). The outputs of the four ATMs (two ATMs from each of the two variables) are connected to solid state logic which is arranged in a one-out-of-two taken twice configuration. The logic can also be initiated by use of a manual push button. The initiation signal is a sealed in signal and must be manually reset. Upon receipt of an initiation signal, the LPCS pump is started immediately after power is available.

(continued)

CLINTON B 3.3-85 Revision No. 10-6

ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND Diesel Generators (continued) started manually from the control room and locally in the associated DG room. The DG initiation signal is a sealed in signal and must be manually reset. The DG initiation logic is reset by resetting the associated ECCS initiation logic.

Upon receipt of a LOCA initiation signal, each DG is automatically started, is ready to load in approximately 12 seconds, and will run in standby conditions (rated voltage and speed, with the DG output breaker open). The DGs will only energize their respective Engineered Safety Feature (ESF) buses if a loss of offsite power occurs.

(Refer to Bases for LCO 3.3.8.1.)

APPLICABLE The actions of the ECCS are explicitly assumed in the safety SAFETY ANALYSES, analyses of References 1, 2, and 3. The ECCS is initiated LCO, and to preserve the integrity of the fuel cladding by limiting APPLICABILITY the post LOCA peak cladding temperature to less than the 10 CFR 50.46 limits.

ECCS instrumentation satisfies Criterion 3 of the NRC Policy Statement. Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.

The OPERABILITY of the ECCS instrumentation is dependent upon the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.5.1-1. Each Function must have a required number of OPERABLE channels, with their setpoints within the specified Allowable Values, where appropriate. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Each ECCS subsystem must also respond within its assumed response time. Table 3.3.5.1-1, footnote (b), is added to show that certain ECCS instrumentation Functions are also required to be OPERABLE to perform DG initiation.

Allowable Values are specified for each ECCS Function specified in the table. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the actual setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. A channel is inoperable if its actual trip (continued)

CLINTON B 3.3-91 Revision No. 10-6

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE setpoint is not within its required Allowable Value. Trip SAFETY ANALYSES, setpoints are those predetermined values of output at which LCO, and an action should take place. The setpoints are compared to APPLICABILITY the actual process parameter (e.g., reactor vessel water (continued) level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g.,

ATM) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values and trip setpoints are derived from the analytic limits, accounting for applicable process errors, severe environment errors, instrument errors (e.g., drift), and calibration errors in accordance with the setpoint methodology documented in the Operational Requirements Manual (ORM). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.

Certain ECCS valves (e.g., minimum flow) also serve the dual function of automatic PCIVs. The signals that provide automatic initiation of the ECCS are also associated with the automatic isolation of these valves. Some instrumentation and ACTIONS associated with these signals are addressed in LCO 3.3.6.1, "Primary Containment and Drywell Isolation Instrumentation," and are not included in this LCO.

In general, the individual Functions are required to be OPERABLE in the MODES or other specified conditions that may require ECCS initiation to mitigate the consequences of a design basis accident or transient. To ensure reliable ECCS and DG function, a combination of Functions is required to provide primary and secondary initiation signals.

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

Low Pressure Core Spray and Low Pressure Coolant Injection Systems l.a, 2.a Reactor Vessel Water Level-Low Low Low, Level 1 Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened. Should (continued)

CLINTON B 3.3-92 Revision No. 10-6

ECCS Instrumentation B 3.3.5.1 BASES SURVEILLANCE SR 3.3.5.1.2 (continued)

REQUIREMENTS Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Frequency of 92 days is based on the reliability analyses of Reference 4.

SR 3.3.5.1.3 The calibration of ATMs provides a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be not within its required Allowable Value specified in Table 3.3.5.1-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analyses. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than the setting accounted for in the appropriate setpoint methodology.

The SR 3.3.5.1.3 calibration for selected Functions is modified by a Note as identified in Table 3.3.5.1-1. This Note, which applies only to those Functions identified in Table 3.3.5.1-1, is divided into three parts. Part 1 of the Note requires evaluation of instrument performance for the condition where the as-found setting for these instrument channels is outside its As-Found Tolerance (AFT) but conservative with respect to the Allowable Value.

Evaluation of instrument performance will verify that the instrument will continue to behave in accordance with design-basis assumptions. The purpose of the assessment is to ensure confidence in the instrument performance prior to returning the instrument to service. Initial evaluation will be performed by the technician performing the surveillance who will evaluate the instrument's ability to maintain a stable setpoint within the As-Left Tolerance (ALT). The technician's evaluation will be reviewed by on-shift operations personnel during the approval of the surveillance data. Subsequent to returning the instrument to service, the deviation is entered into the Corrective Action Program. In accordance with procedures, entry into the Corrective Action Program will require review and documentation of the condition for operability by on-shift operations personnel. Additional evaluation and potential corrective actions as necessary will ensure that any as-found setting found outside the AFT is evaluated for long-term operability trends. If the as-found channel setpoint is not conservative with respect to the Allowable Value, the (continued)

CLINTON B 3.3-120 Revision No. 10-6

ECCS Instrumentation B 3.3.5.1 BASES SURVEILLANCE SR 3.3.5.1.3 (continued)

REQUIREMENTS channel shall be declared inoperable. Part 2 of the Note requires that the instrument channel setpoint shall be reset to within the ALT of the Actual Trip Setpoint (ATSP). The ATSP is equivalent to or more conservative than the Nominal Trip Setpoint (NTSP). The NTSP is the limiting value of the sensed process variable at which a trip may be set in accordance with the methodology documented in the ORM.

Therefore, the NTSP is equivalent to the Limiting Safety System Setting (LSSS) required by 10 CFR 50.36, "Technical specifications." The Actual Trip Setpoint is also calculated in accordance with the plant-specific setpoint methodology as documented in the CPS ORM and may include additional margin. The ATSP will ensure that sufficient margin to the safety and/or analytical limit is maintained.

If the as-left instrument channel setpoint cannot be returned to within the ALT of the Actual Trip Setpoint, then the channel shall be declared inoperable. Part 3 of the Note indicates that the Nominal Trip Setpoint and the methodology used to determine the Nominal Trip Setpoint, the As-Found Tolerance and the As-Left Tolerance bands are specified in the ORM.

The Frequency of 92 days is based on the reliability analysis of Reference 4.

SR 3.3.5.1.4 and SR 3.3.5.1.6 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The SR 3.3.5.1.4 and SR 3.3.5.1.6 calibrations for selected I Functions are modified by a Note as identified in Table 3.3.5.1-1. This Note, which applies only to those Functions identified in Table 3.3.5.1-1, is divided into three parts.

Part 1 of the Note requires evaluation of instrument performance for the condition where the as-found setting for these instrument channels is outside its As-Found Tolerance (AFT) but conservative with respect to the Allowable Value.

Evaluation of instrument performance will verify that the instrument will continue to behave in accordance with design-basis assumptions. The purpose of the assessment is to ensure confidence in the instrument performance prior to returning the instrument to service. Initial evaluation will be performed by the technician performing the surveillance who will evaluate the instrument's ability to maintain a stable setpoint within the As-Left Tolerance (ALT). The technician's evaluation will be reviewed by on-shift operations personnel during the approval of the (continued)

CLINTON B 3.3-120a Revision No. 10-7

ECCS Instrumentation B 3.3.5.1 BASES SURVEILLANCE SR 3.3.5.1.4 and SR 3.3.5.1.6 (continued)

REQUIREMENTS surveillance data. Subsequent to returning the instrument to service, the deviation is entered into the Corrective Action Program. In accordance with procedures, entry into the Corrective Action Program will require review and documentation of the condition for operability by on-shift operations personnel. Additional evaluation and potential corrective actions as necessary will ensure that any as-found setting found outside the AFT is evaluated for long-term operability trends. If the as-found channel setpoint is not conservative with respect to the Allowable Value, the channel shall be declared inoperable. Part 2 of the Note requires that the instrument channel setpoint shall be reset to within the ALT of the Actual Trip Setpoint (ATSP). The ATSP is equivalent to or more conservative than the Nominal Trip Setpoint (NTSP). The NTSP is the limiting value of the sensed process variable at which a trip may be set in accordance with the methodology documented in the ORM.

Therefore, the NTSP is equivalent to the Limiting Safety System Setting (LSSS) required by 10 CFR 50.36, "Technical specifications." The Actual Trip Setpoint is also calculated in accordance with the plant-specific setpoint methodology as documented in the CPS ORM and may include additional margin. The ATSP will ensure that sufficient margin to the safety and/or analytical limit is maintained.

If the as-left instrument channel setpoint cannot be returned to within the ALT of the Actual Trip Setpoint, then the channel shall be declared inoperable. Part 3 of the Note indicates that the Nominal Trip Setpoint and the methodology used to determine the Nominal Trip Setpoint, the As-Found Tolerance and the As-Left Tolerance bands are specified in the ORM.

The Frequencies are based upon the assumption of the magnitude of equipment drift in the setpoint analysis.

(continued)

CLINTON B 3.3-120b Revision No. 10-7

ECCS Instrumentation B 3.3.5.1 BASES SURVEILLANCE SR 3.3.5.1.5 REQUIREMENTS (continued) The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel. The system functional testing performed in LCO 3.5.1, LCO 3.5.2, LCO 3.7.2, LCO 3.8.1, and LCO 3.8.2 overlaps this Surveillance to provide complete testing of the assumed safety function.

The Self Test System may be utilized to perform this testing for those components that it is designed to monitor. Those portions of the solid-state logic not monitored by the Self Test System may be tested at the frequency recommended by the manufacturer, rather than at the specified 24-month Frequency. The frequencies recommended by the manufacturer are based on mean time between failure analysis for the components in the associated circuits.

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for unplanned transients if the Surveillance were performed with the reactor at power.

Operating experience has shown these components usually pass the Surveillance.

REFERENCES 1. USAR, Section 5.2.2.

2. USAR, Section 6.3.

3. USAR, Chapter 15.

4. NEDC-30936-P-A, "BWR Owners' Group Technical Specification Improvement Analyses for ECCS Actuation Instrumentation, Part 2," December 1988.

CLINTON B 3.3-121 Revision No. 10-7

RCIC System Instrumentation B 3.3.5.2 BASES SURVEILLANCE SR 3.3.5.2.2 (continued)

REQUIREMENTS be consistent with the assumptions of the current plant specific setpoint methodology.

The Frequency of 92 days is based on the reliability analysis of Reference 2.

SR 3.3.5.2.3 The calibration of analog trip modules provides a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.5.2-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be re-adjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.

The Frequency of 92 days is based on the reliability analysis of Reference 2.

SR 3.3.5.2.4 and SR 3.3.5.2.6 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter with the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Frequencies are based on the assumption of the magnitude of equipment drift in the setpoint analysis.

SR 3.3.5.2.5 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel. The system functional testing performed in LCO 3.5.3 overlaps this Surveillance to provide complete testing of the safety function.

(continued)

CLINTON B 3.3-133 Revision No. 10-7

RCIC System Instrumentation B 3.3.5.2 BASES SURVEILLANCE SR 3.3.5.2.5 (continued)

REQUIREMENTS The Self Test System may be utilized to perform this testing for those components that it is designed to monitor. Those portions of the solid-state logic not monitored by the Self Test System may be tested at the frequency recommended by the manufacturer, rather than at the specified 24-month I Frequency. The frequencies recommended by the manufacturer are based on mean time between failure analysis for the components in the associated circuits.

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown that these components usually pass the Surveillance. I REFERENCES 1. USAR, Section 15.4.9.

2. NEDE-770-06-2, "Addendum to Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications," February 1991.

3. USAR, Section 5.4.6.

CLINTON B 3.3-134 Revision No. 10-7

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 4.f. Reactor Vessel Water Level-Low Low, Level 2 SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY containment. Thus, this Function is also required under those conditions in which a low reactor water level signal

.could be generated when secondary containment is required to be OPERABLE.

4.g. SLC System Initiation The isolation of the RWCU System is required when the SLC System has been initiated to prevent dilution and removal of the boron solution by the RWCU System (Ref. 4). SLC System initiation signals are initiated from the two SLC pump start signals.

There is no Allowable Value associated with this Function since the channels are mechanically actuated based solely on the position of the SLC System initiation switch.

Two channels (one from each pump) of SLC System Initiation Function are available and are required to be OPERABLE in MODES 1 and 2, since these are the only MODES where the reactor can be critical. Both channels are also required to be OPERABLE in MODES 1, 2, and 3, since the SLC System is also used to maintain suppression pool pH at or above 7 following a LOCA to ensure that iodine will be retained in the suppression pool water. These MODES are consistent with the Applicability for the SLC System (LCO 3.1.7).

4.h. Manual Initiation The Manual Initiation push button channels introduce signals into the RWCU System isolation logic that are redundant to the automatic protective instrumentation and provide manual isolation capability. There is no specific USAR safety analysis that takes credit for this Function. It is retained for the isolation function as required by the NRC in plant licensing basis.

There are two push buttons for the logic, one manual initiation push button per trip system. There is no Allowable Value for this Function, since the channels are mechanically actuated based solely on the position of the push buttons.

Two channels of the Manual Initiation Function are available and are required to be OPERABLE. This Function is also required to be OPERABLE during movement of recently (continued)

CLINTON B 3.3-157 Revision No. 10-5

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES ACTIONS K.I and K.2 (continued)

If the channel is not restored to OPERABLE status or placed in trip, or any Required Action of Condition I or J is not met and the associated Completion Time has expired, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. This is done by placing the plant in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

L.1 and L.2 If the channel is not restored to OPERABLE status within the allowed Completion Time, the associated SLC subsystem(s) is declared inoperable or the RWCU System is isolated. Since this Function is required to ensure that the SLC System performs its intended function, sufficient remedial measures are provided by declaring the associated SLC subsystem inoperable or isolating the RWCU System.

The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is acceptable because it minimizes risk while allowing sufficient time for personnel to isolate the RWCU System. RWCU isolation is achieved by closing IG33F001 or IG33F004, which are the containment isolation valves associated with this isolation function.

M.1, M.2, M.3.1, M.3.2, M.3.3, and M.3.4 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the associated penetration flow path should be isolated (i.e., closing either 1E12-F008 or 1E12-F009). However, if the shutdown cooling function is needed to provide core cooling, these Required Actions allow the penetration flow path to remain unisolated provided action is immediately initiated to restore the channel to OPERABLE status or to provide means for control of potential radioactive releases. This includes ensuring secondary containment is OPERABLE; at least one Standby Gas Treatment (SGT) subsystem is OPERABLE; and secondary containment isolation capability (i.e., at least one isolation valve and associated instrumentation are OPERABLE or other acceptable administrative controls to assure isolation capability) in each secondary containment and secondary containment bypass penetration flow path not isolated that is assumed to be isolated to mitigate (continued)

CLINTON B 3.3-168 Revision No. 10-4

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES SURVEILLANCE SR 3.3.6.1.1 (continued)

REQUIREMENTS The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

SR 3.3.6.1.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. For series Functions, a separate CHANNEL FUNCTIONAL TEST is not required for each Function, provided each Function is tested. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Frequency is based on reliability analysis described in References 5 and 6.

SR 3.3.6.1.3 The calibration of analog trip modules consists of a test to provide a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.6.1-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.

The Frequency of 92 days is based on the reliability analysis of References 5 and 6.

SR 3.3.6.1.4, SR 3.3.6.1.5, and SR 3.3.6.1.8 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel (continued)

CLINTON B 3.3-171 Revision No. 10-7

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES SURVEILLANCE SR 3.3.6.1.4, SR 3.3.6.1.5, and SR 3.3.6.1.8 (continued)

REQUIREMENTS responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Frequencies of SR 3.3.6.1.4, SR 3.3.6.1.5, and SR 3.3.6.1.8 are based on the assumption of the magnitude of equipment drift in the setpoint analysis.

SR 3.3.6.1.6 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required isolation logic for a specific channel. The system functional testing performed on PCIVs in LCO 3.6.1.3 and on drywell isolation valves in LCO 3.6.5.3 overlaps this Surveillance to provide complete testing of the assumed safety function. (Likewise, system functional testing performed pursuant to LCO 3.7.1 overlaps this Surveillance to provide complete testing for verifying automatic actuation capability for the Division 1 and 2 SX subsystems.) The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown these components usually pass the Surveillance.

The Self Test System may be utilized to perform this testing for those components that it is designed to monitor. Those portions of the solid-state logic not monitored by the Self Test System may be tested at the frequency recommended by the manufacturer, rather than at the specified 24-month Frequency. The frequencies recommended by the manufacturer are based on mean time between failure analysis for the components in the associated circuits.

SR 3.3.6.1.7 This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis. Testing is performed only on channels where the assumed response time does not correspond to the (continued)

CLINTON B 3.3-172 Revision No. 10-7

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES SURVEILLANCE SR 3.3.6.1.7 (continued)

REQUIREMENTS diesel generator (DG) start time. For channels assumed to respond within the DG start time, sufficient margin exists in the 12 second start time when compared to the typical channel response time (milliseconds) so as to assure adequate response without a specific measurement test. The instrument response times must be added to the MSIV closure times to obtain the ISOLATION SYSTEM RESPONSE TIME.

ISOLATION SYSTEM RESPONSE TIME acceptance criteria are included in applicable plant procedures.

As noted, the associated sensors are not required to be response time tested. Response time testing for the remaining channel components, including the ATMs, is required. This is supported by Reference 7.

Note 2 to SR 3.3.6.1.7 requires the STAGGERED TEST BASIS Frequency for each Function to be determined seperately based on the number of channels as specified on Table 3.3.6.1-1. This Frequency is based on the logic interrelationships of the various channels required to produce an isolation signal.

ISOLATION SYSTEM RESPONSE TIME tests are conducted on an 24 month STAGGERED TEST BASIS. This Frequency is consistent with the typical industry refueling cycle and is based upon plant operating experience that shows that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent.

With regard to ISOLATION SYSTEM RESPONSE TIME values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 8).

REFERENCES 1. USAR, Section 6.2.

2. USAR, Chapter 15.

3. NEDO-31466, "Technical Specification Screening Criteria Application and Risk Assessment,"

November 1987.

4. USAR, Section 9.3.5.

(continued)

CLINTON B 3.3-173 Revision No. 10-7

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES SURVEILLANCE SR 3.3.6.2.3 (continued)

REQUIREMENTS The Frequency of 92 days is based on the reliability analysis of References 3 and 4.

SR 3.3.6.2.4 and SR 3.3.6.2.6 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Frequencies are based upon the assumption of the magnitude of equipment drift in the setpoint analysis.

SR 3.3.6.2.5 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required isolation logic for a specific channel. The system functional testing, performed on SCIDs and the SGT System in LCO 3.6.4.2 and LCO 3.6.4.3, respectively, overlaps this Surveillance to provide complete testing of the assumed safety function.

The Self Test System may be utilized to perform this testing for those components that it is designed to monitor. Those portions of the solid-state logic not monitored by the Self Test System may be tested at the frequency recommended by the manufacturer, rather than at the specified 24-month Frequency. The frequencies recommended by the manufacturer are based on mean time between failure analysis for the components in the associated circuits.

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

(continued)

CLINTON B 3.3-184 Revision No. 10-7

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES SURVEILLANCE SR 3.3.6.2.5 (continued)

REQUIREMENTS Operating experience has shown these components usually pass the Surveillance. I REFERENCES 1. USAR, Section 6.2.3.

2. USAR, Chapter 15.

3. NEDO-31677-P-A, "Technical Specification Improvement Analysis for BWR Isolation Actuation Instrumentation,"

July 1990.

4. NEDC-30851-P-A Supplement 2, "Technical Specifications Improvement Analysis for BWR Isolation Instrumentations Common to RPS and ECCS Instrumentation," March 1989.

5. USAR, Section 7.3.1.1.2.

6. USAR, Section 7.1.2.1.11.

7. USAR, Section 7.3.1.1.9.2.

8. USAR, Section 7.6.1.2.

CLINTON B 3.3-185 Revision No. 10-7

RHR Containment Spray System Instrumentation B 3.3.6.3 BASES APPLICABLE 2. Containment Pressure-High (continued)

SAFETY ANALYSES, LCO, and This ensures that no single instrument failure can preclude APPLICABILITY the RHR containment spray function.

The Containment Pressure-High Allowable Value is chosen to ensure the primary containment design pressure is not exceeded.

3. Reactor Vessel Water Level-Low Low Low, Level 1 Low reactor pressure vessel (RPV) water level indicates that a break of the RCPB may have occurred and the capability to maintain the primary containment pressure within design limits may be threatened. The RHR Containment Spray System mitigates the consequences of the steam leaking from the drywell directly into the containment airspace, bypassing the suppression pool.

Reactor vessel water level signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level-Low Low Low, Level 1 (two per trip system) are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the RHR containment spray function.

The Reactor Vessel Water Level-Low Low Low, Level 1 Allowable Value is chosen to be the same as the ECCS Reactor Vessel Water Level-Low Low Low, Level 1 Allowable Value (LCO 3.3.5.1) since this could be indicative of a LOCA. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.

4, 5. System A and System B Timers The purpose of the System A and System B timers is to delay automatic initiation of the RHR Containment Spray System for approximately 600 seconds after low pressure coolant injection (LPCI) initiation to give the LPCI System time to fulfill its ECCS function in response to a LOCA. The time delay is needed since the RHR Containment Spray System utilizes the same pumps as the LPCI subsystem (RHR pumps).

(continued)

CLINTON B 3.3-189 Revision No. 10-7

RHR Containment Spray System Instrumentation B 3.3.6.3 BASES SURVEILLANCE SR 3.3.6.3.2 REQUIREMENTS (continued) A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure the entire channel will perform the intended function. For Series Functions, a separate CHANNEL FUNCTIONAL TEST is not required for each Function, provided each Function is tested. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Frequency of 92 days is based upon the reliability analysis of Reference 3.

SR 3.3.6.3.3 The calibration of analog trip modules provides a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.6.3-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.

The Frequency of 92 days is based upon the reliability analysis of Reference 3.

SR 3.3.6.3.4 and SR 3.3.6.3.6 I A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Frequencies are based on the assumption of'the magnitude of equipment drift in the setpoint analysis.

(continued)

CLINTON B 3.3-195 Revision No. 10-7

RHR Containment Spray System Instrumentation B 3.3.6.3 BASES SURVEILLANCE SR 3.3.6.3.5 REQUIREMENTS (continued) The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel. The system functional testing performed in LCO 3.6.1.7, "Residual Heat Removal (RHR) Containment Spray," overlaps this Surveillance to provide complete testing of the assumed safety function.

The Self Test System may be utilized to perform this testing for those components that it is designed to monitor. Those portions of the solid-state logic not monitored by the Self Test System may be tested at the frequency recommended by the manufacturer, rather than at the specified 24-month I Frequency. The frequencies recommended by the manufacturer are based on mean time between failure analysis for the components in the associated circuits.

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant I

outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown these components usually pass I the Surveillance.

REFERENCES 1. USAR, Section 7.3.1.1.4.

2. USAR, Section 6.2.1.1.5.

3. GENE-770-06-1, "Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications,"

February 1991.

CLINTON B 3.3-196 Revision No. 10-7

SPMU System Instrumentation B 3.3.6.4 BASES SURVEILLANCE SR 3.3.6.4.2 REQUIREMENTS (continued) A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure the entire channel will perform the intended function. For Series Functions, a separate CHANNEL FUNCTIONAL TEST is not required for each Function, provided each Function is tested. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Frequency of 92 days is based on the reliability analysis of Reference 3.

SR 3.3.6.4.3 and SR 3.3.6.4.4 The calibration of analog trip modules and analog comparator units provides a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.6.4-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.

The Frequency of 92 days is based on the reliability analysis of Reference 3.

SR 3.3.6.4.5, SR 3.3.6.4.6, and SR 3.3.6.4.8 I A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

(continued)

CLINTON B 3.3-206 Revision No. 10-7

SPMU System Instrumentation B 3.3.6.4 BASES SURVEILLANCE SR 3.3.6.4.5, SR 3.3.6.4.6, and SR 3.3.6.4.8 (continued)

REQUIREMENTS The Frequencies are based on the assumption of the magnitude of equipment drift in the setpoint analysis.

SR 3.3.6.4.7 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel. The system functional testing performed in LCO 3.6.2.4, "Suppression Pool Makeup (SPMU) System,"

overlaps this Surveillance to provide complete testing of the assumed safety function.

The Self Test System may be utilized to perform this testing for those components that it is designed to monitor. Those portions of the solid-state logic not monitored by the Self Test System may be tested at the frequency recommended by the manufacturer, rather than at the specified 24-month Frequency. The frequencies recommended by the manufacturer are based on mean time between failure analysis for the components in the associated circuits.

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown these components usually pass the Surveillance.

REFERENCES 1. USAR, Section 7.3.1.1.10

2. USAR, Section 6.2.7.

3. GENE-770-06-1, "Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications,"

February 1991.

CLINTON B 3.3-207 Revision No. 10-7

Relief and LLS Instrumentation B 3.3.6.5 B 3.3 INSTRUMENTATION B 3.3.6.5 Relief and Low-Low Set (LLS) Instrumentation BASES BACKGROUND The safety/relief valves (S/RVs) prevent overpressurization of the nuclear steam system. Instrumentation is provided to support two modes (in addition to the automatic depressurization system (ADS) mode of operation for selected valves) of S/RV operation-the relief function (all valves) and the LLS function (selected valves). Refer to LCO 3.4.4, "Safety/Relief Valves (S/RVs)," and LCO 3.6.1.6, "Low-Low Set (LLS) Safety/Relief Valves (S/RVs)," Applicability Bases for additional information on these modes of S/RV operation.

For the ADS mode of operation and associated instrumentation, refer to LCO 3.5.1, "Emergency Core Cooling Systems (ECCS)-Operating," and LCO 3.3.5.1, "ECCS Instrumentation," respectively.

The relief function of the S/RVs prevents overpressurization of the nuclear steam system. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the S/RV relief function instrumentation, as well as LCOs on other reactor system parameters, and equipment performance. The LSSS are defined in this Specification as the Allowable Values, except for the relief Function (the Nominal Trip Setpoint defines the LSSS for this function), which, in conjunction with the LCOs, establish the threshold for protective system action to prevent exceeding acceptable limits, including Safety Limits (SLs), during Anticipated Operational Occurrences (AOOs) and Design Basis Accidents (DBAs).

The LLS function of the S/RVs is designed to mitigate the effects of postulated pressure loads on the containment by preventing multiple actuations in rapid succession of the S/RVs subsequent to their initial actuation. Upon any S/RV actuation, the LLS logic assigns preset opening setpoints to two preselected S/RVs and reclosing setpoints to five preselected S/RVs. These setpoints are selected to override the normal relief setpoints such that the LLS S/RVs will stay open longer, thus releasing more steam (energy) to the suppression pool; hence more energy (and time) is required for repressurization and subsequent S/RV openings. The LLS logic is divided into three logic groups (the low and medium setpoint groups each control one valve (i.e., valves 1B21-F051D and 1B21-F051C, respectively) and the high setpoint group controls the remaining three valves (i.e., valves IB21-F047F, 1B21-F051B, and IB21-FO51G)). The LLS logic increases the time between (or prevents) subsequent actuations to limit S/RV subsequent actuations to one valve, so that containment loads will also be reduced.

(continued)

CLINTON B 3.3-208 Revision No. 10-6

Relief and LLS Instrumentation B 3.3.6.5 BASES (continued)

LCO The LCO requires OPERABILITY of sufficient relief and LLS instrumentation channels to provide adequate assurance of successfully accomplishing the relief and LLS function, assuming any single instrumentation channel failure within the LLS logic. Therefore, two trip systems are required to be OPERABLE. The OPERABILITY of each trip system is dependent upon the OPERABILITY of the reactor steam dome pressure channels associated with required relief and LLS S/RVs. Each required channel shall have its setpoint within the specified Allowable Value. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Allowable Values are specified for each channel in SR 3.3.6.5.3. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the actual setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value.

Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel pressure), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., ATM) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values and trip setpoints are derived from the analytic limits, accounting for applicable process errors, severe environment errors, instrument errors (e.g., drift), and calibration errors in accordance with the setpoint methodology documented in the Operational Requirements Manual (ORM).

The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.

For relief, the actuating Allowable Values are based on the transient event of main steam isolation valve (MSIV) closure with an indirect scram (i.e., neutron flux). This analysis is described in Reference 1. For LLS, the actuating and reclosing Allowable Values are based on the transient event (continued)

CLINTON B 3.3-210 Revision No. 10-6

Relief and LLS Instrumentation B 3.3.6.5 BASES SURVEILLANCE SR 3.3.6.5.2 REQUIREMENTS (continued) The calibration of analog trip modules provides a check of.

the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less:

conservative than the Allowable Value specified in SR 3.3.6.5.3. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.

The SR 3.3.6.5.2 calibration is modified by a Note. This Note is divided into three parts. Part 1 of the Note requires evaluation of instrument performance for the condition where the as-found setting for these instrument channels is outside its As-Found Tolerance (AFT) but conservative with respect to the Allowable Value.

Evaluation of instrument performance will verify that the instrument will continue to behave in accordance with design-basis assumptions. The purpose of the assessment is to ensure confidence in the instrument performance prior to returning the instrument to service. Initial evaluation will be performed by the technician performing the surveillance who will evaluate the instrument's ability to maintain a stable setpoint within the As-Left Tolerance (ALT). The technician's evaluation will be reviewed by on-shift operations personnel during the approval of the surveillance data. Subsequent to returning the instrument to service, the deviation is entered into the Corrective Action Program. In accordance with procedures, entry into the Corrective Action Program will require review and documentation of the condition for operability by on-shift operations personnel. Additional evaluation and potential corrective actions as necessary will ensure that any as-found setting found outside the AFT is evaluated for long-term operability trends. If the as-found channel setpoint is not conservative with respect to the Allowable Value, the channel shall be declared inoperable. Part 2 of the Note requires that the instrument channel setpoint shall be reset to within the ALT of the Actual Trip Setpoint (ATSP). The ATSP is equivalent to or more conservative than the Nominal Trip Setpoint (NTSP). The NTSP is the limiting value of the sensed process variable at which a trip may be set in accordance with the methodology documented in the ORM.

Therefore, the NTSP is equivalent to the Limiting Safety System Setting (LSSS) required by 10 CFR 50.36, 'Technical specifications." The Actual Trip Setpoint is also calculated in accordance with the plant-specific setpoint methodology as documented in the CPS ORM and may include additional margin. The ATSP will ensure that sufficient margin to the safety and/or analytical limit is maintained.

(continued)

CLINTON B 3.3-213 Revision No. 10-6

Relief and LLS Instrumentation B 3.3.6.5 BASES SURVEILLANCE SR 3.3.6.5.2 (continued)

REQUIREMENTS If the as-left instrument channel setpoint cannot be returned to within the ALT of the Actual Trip Setpoint, then the channel shall be declared inoperable. Part 3 of the Note indicates that the Nominal Trip Setpoint and the methodology used to determine the Nominal Trip Setpoint, the As-Found Tolerance and the As-Left Tolerance bands are specified in the ORM.

The Frequency of 92 days is based on the reliability analysis of Reference 3.

SR 3.3.6.5.3 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The SR 3.3.6.5.3 calibration is modified by a Note. This Note is divided into three parts. Part 1 of the Note requires evaluation of instrument performance for the condition where the as-found setting for these instrument channels is outside its As-Found Tolerance (AFT) but conservative with respect to the Allowable Value.

Evaluation of instrument performance will verify that the instrument will continue to behave in accordance with design-basis assumptions. The purpose of the assessment is to ensure confidence in the instrument performance prior to returning the instrument to service. Initial evaluation will be performed by the technician performing the surveillance who will evaluate the instrument's ability to maintain a stable setpoint within the As-Left Tolerance (ALT). The technician's evaluation will be reviewed by on-shift operations personnel during the approval of the surveillance data. Subsequent to returning the instrument to service, the deviation is entered into the Corrective Action Program. In accordance with procedures, entry into the Corrective Action Program will require review and documentation of the condition for operability by on-shift operations personnel. Additional evaluation and potential corrective actions as necessary will ensure that any as-found setting found outside the AFT is evaluated for long-term operability trends. If the as-found channel setpoint is not conservative with respect to the Allowable Value, the channel shall be declared inoperable. Part 2 of the Note requires that the instrument channel setpoint shall be reset to within the ALT of the Actual Trip Setpoint (ATSP). The ATSP is equivalent to or more conservative than the Nominal (continued)

CLINTON B 3.3-213a Revision No. 10-6

Relief and LLS Instrumentation B 3.3.6.5 BASES SURVEILLANCE SR 3.3.6.5.3 (continued)

REQUIREMENTS Trip Setpoint (NTSP). The NTSP is the limiting value of the sensed process variable at which a trip may be set in accordance with the methodology documented in the ORM.

Therefore, the NTSP is equivalent to the Limiting Safety System Setting (LSSS) required by 10 CFR 50.36, "Technical specifications." The Actual Trip Setpoint is also calculated in accordance with the plant-specific setpoint methodology as documented in the CPS ORM and may include additional margin. The ATSP will ensure that sufficient margin to the safety and/or analytical limit is maintained.

If the as-left instrument channel setpoint cannot be returned to within the ALT of the Actual Trip Setpoint, then the channel shall be declared inoperable. Part 3 of the Note indicates that the Nominal Trip Setpoint and the methodology used to determine the Nominal Trip Setpoint, the As-Found Tolerance and the As-Left Tolerance bands are specified in the ORM.

The Frequency is based upon the assumption of the magnitude of equipment drift in the setpoint analysis.

SR 3.3.6.5.4 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required actuation logic for a specific channel. The system functional testing performed for S/RVs in LCO 3.4.4 and LCO 3.6.1.6 overlaps this Surveillance to provide complete testing of the assumed safety function.

The Self Test System may be utilized to perform this testing for those components that it is designed to monitor. Those portions of the solid-state logic not monitored by the Self Test System may be tested at the frequency recommended by the manufacturer, rather than at the specified 24-month (continued)

CLINTON B 3.3-213b Revision No. 10-7

Relief and LLS Instrumentation B 3.3.6.5 BASES SURVEILLANCE SR 3.3.6.5.4 (continued)

REQUIREMENTS Frequency. The frequencies recommended by the manufacturer are based on mean time between failure analysis for the components in the associated circuits.

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown these components usually pass the Surveillance. I REFERENCES 1. USAR, Section 5.2.2.

2. USAR, Section 7.3.1.1.1.4.2.

3. GENE-770-06-1, "Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications,"

February 1991.

CLINTON B 3.3-214 Revision No. 10-7

LOP Instrumentation B 3.3.8.1 BASES APPLICABLE the measured output value of the process parameter exceeds SAFETY ANALYSES, the setpoint, the associated device (e.g., undervoltage LCO, and relay) changes state. The analytic limits are derived from APPLICABILITY the limiting values of the process parameters obtained from (continued) the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

4.16 kV Emergency Bus Undervoltage l.a, l.b, 2.a, 2.b. 4.16 kV Emergency Bus Undervoltage (Loss of Voltage)

Loss of voltage on a 4.16 kV emergency bus indicates that offsite power may be completely lost to the respective emergency bus and is unable to supply sufficient power for proper operation of the applicable equipment. Therefore, the power supply to the bus is transferred from offsite power to DG power when the voltages on the bus and the two offsite power supplies drop below the Loss of Voltage Function Allowable Values (loss of voltage with a short time delay). This ensures that adequate power will be available to the required equipment.

The Bus Undervoltage Allowable Values are low enough to prevent inadvertent power supply transfer, but high enough to ensure power is available to the required equipment. The Time Delay Allowable Values are long enough to provide time for the offsite power supply to recover to normal voltages, but short enough to ensure that power is available to the required equipment. The time delay specified for the Divisions 1 and 2 4.16 kV Emergency Bus Loss of Voltage Functions corresponds to a voltage of 0 volts. Higher voltage conditions will result in increased trip times. I (continued)

CLINTON B 3.3-224 Revision No. 10-7

LOP Instrumentation B 3.3.8.1 BASES APPLICABLE 1.c, l.d, 1.e, 2.c, 2.d, 2.e. 4.16 kV Emergency Bus SAFETY ANALYSES, Undervoltage (Degraded Voltage) (continued)

LCO, and APPLICABILITY sufficient magnitude to start the degraded voltage timers.

If the degraded voltage relays do not reset, which requires the voltage to be restored to a level above the relay reset setpoint, the bus undervoltage time delay relays will trip, resulting in bus transfer to the DGs. Thus, the relay reset (pick-up) setpoint must be high enough to ensure adequate voltage for the safety-related loads.

The Allowable Values are as determined within IP Calculation 19-AN-19 (Ref. 5). The basis for the reset Allowable Value upper limit is the avoidance of shifting to the onsite source when the offsite source is acceptable as specified within GDC 17. The basis for the reset Allowable Value lower limit is the minimum voltage required to support the LOCA loads. The basis for the dropout Allowable Value lower limit ensures adequate voltage to start plant equipment I

under non-LOCA loading conditions. Because of the voltage transient experienced at the start of a LOCA, the specified Degraded Voltage drop-out Allowable Value lower limit provides significant margin to the setting required to mitigate a LOCA. This value was selected based on other licensing basis events discussed in USAR, Section 8.3.1.1.2 (Ref. 1) and calculated in IP Calculation 19-AN-19.

The upper and lower Allowable Values specified for the degraded voltage reset (pick-up) function constitute an allowable band for this function. These solid-state relays are designed with a fixed but adjustable deadband. (The reset is set first, then the drop-out is set via a potentiometer.) Allowable values are specified to allow for I drift in either direction, but the drop-out and reset points cannot overlap.

(continued)

CLINTON B 3.3-225a Revision No. 10-7

LOP Instrumentation B 3.3.8.1 BASES APPLICABLE l.c, 1.d, 1.e, 2.c, 2.d, 2.e. 4.16 kV Emergency Bus SAFETY ANALYSES, Undervoltage (Degraded Voltage) (continued)

LCO, and APPLICABILITY The Time Delay Allowable Values are long enough to provide time for the offsite power supply to recover to normal voltages, but short enough to ensure that sufficient power is available to the required equipment.

Two channels of 4.16 kV Emergency Bus Undervoltage (Degraded Voltage) Function per associated emergency bus for Divisions 1, 2, and 3 are only required to be OPERABLE when the associated DG is required to be OPERABLE to ensure that no single instrument failure can preclude the DG function.

(Two channels input to each of the Division 1, 2, and 3 DGs.

The Degraded Voltage Function logic for each Division inputs to a single time delay relay. Thus, only one time delay channel is associated with each Division.) Refer to LCO 3.8.1 and LCO 3.8.2 for Applicability Bases for the DGs.

ACTIONS A Note has been provided to modify the ACTIONS related to LOP instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable LOP instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable LOP instrumentation channel.

(continued)

CLINTON B 3.3-226 Revision No. 10-7

LOP Instrumentation B 3.3.8.1 BASES SURVEILLANCE SR 3.3.8.1.3 REQUIREMENTS (continued) A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Frequency is based on the assumption of the magnitude of equipment drift in the setpoint analysis.

SR 3.3.8.1.4 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required actuation logic for a specific channel. The system functional testing performed in LCO 3.8.1 and LCO 3.8.2 overlaps this Surveillance to provide complete testing of the assumed safety functions.

The 24 month Frequency is based on the need to perform this I Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown these components usually pass the Surveillance.

REFERENCES 1. USAR, Section 8.3.1.1.2.

2. USAR, Section 5.2.2.

3. USAR, Section 6.3.3.

4. USAR, Chapter 15.

5. IP Calculation 19-AN-19.

CLINTON B 3.3-229 Revision No. 10-7

RPS Electric Power Monitoring B 3.3.8.2 BASES SURVEILLANCE SR 3.3.8.2.1 (continued)

REQUIREMENTS Surveillance. The 184 day Frequency and the Note in the Surveillance are based on guidance provided in Generic Letter 91-09 (Ref. 2).

SR 3.3.8.2.2 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Frequency is based upon the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis.

SR 3.3.8.2.3 Performance of a system functional test demonstrates a required system actuation (simulated or actual) signal. The logic of the system will automatically trip open the associated power monitoring assembly circuit breaker. Only one signal per power monitoring assembly is required to be tested. This Surveillance overlaps with the CHANNEL CALIBRATION to provide complete testing of the safety function. The system functional test of the Class 1E circuit breakers is included as part of this test to provide complete testing of the safety function. If the breakers are incapable of operating, the associated electric power monitoring assembly would be inoperable.

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the (continued)

CLINTON B 3.3-235 Revision No. 10-7

RPS Electric Power Monitoring B 3.3.8.2 BASES SURVEILLANCE SR 3.3.8.2.3 (continued)

REQUIREMENTS Surveillance were performed with the reactor at power.

Operating experience has shown that these components usually pass the Surveillance.

REFERENCES 1. USAR, Section 8.3.1.1.3.1.

2. NRC Generic Letter 91-09, "Modification of Surveillance Interval for the Electric Protective Assemblies in Power Supplies for the Reactor Protection System."

CLINTON B 3.3-236 Revision No. 10-7

FCVs B 3.4.2 BASES ACTIONS B.1 (continued)

If the FCVs are not deactivated, (locked up) and cannot be restored to OPERABLE status within the associated Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . This brings the unit to a condition where the flow coastdown characteristics of the recirculation loop are not important. The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.4.2.1 REQUIREMENTS Hydraulic power unit pilot operated isolation valves located between the servo valves and the common "open" and "close" lines are required to close in the event of a loss of hydraulic pressure. When closed, these valves inhibit FCV motion by blocking hydraulic pressure from the servo valve to the common open and close lines as well as to the alternate subloop. This Surveillance verifies FCV lockup on a loss of hydraulic pressure as assumed in the design basis LOCA analyses.

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown these components usually pass the SR. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

(continued)

CLINTON B 3.4-11 Revision No. 10-7

S/RVs B 3.4.4 BASES SURVEILLANCE SR 3.4.4.2 (continued)

REQUIREMENTS The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown these components usually pass the SR. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is modified by a Note that excludes valve actuation.

This prevents an RPV pressure blowdown.

SR 3.4.4.3 A manual actuation of each required S/RV (those valves removed and replaced to satisfy SR 3.4.4.1) is performed to verify that the valve is functioning properly. This SR can be demonstrated by one of two methods. If performed by Method 1, plant startup is allowed prior to performing this test because valve OPERABILITY and the setpoints for overpressure protection are verified, per ASME requirements (Ref. 6), prior to valve installation. Therefore, this SR is modified by a Note that states the Surveillance is not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reactor steam pressure and flow are adequate to perform the test. The 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed for manual actuation after the required pressure is reached is sufficient to achieve stable conditions for testing and provides a reasonable time to complete the SR. If performed by Method 2, valve OPERABILITY has been demonstrated for all installed S/RVs based upon the successful operation of a test sample of S/RVs.

1. Manual actuation of the S/RV with verification of the response of the turbine control valves or bypass valves, by a change in the measured steam flow, or any other method suitable to verify steam flow (e.g.,

tailpipe temperature or acoustic monitoring).

Adequate reactor steam pressure must be available to perform this test to avoid damaging the valve. Also, adequate flow must be passing through the main turbine or turbine bypass valves to continue to control reactor pressure when the S/RVs divert steam flow upon opening. Sufficient time is therefore allowed after the required pressure and flow are achieved to perform this test. Adequate pressure at which this test is to be performed is consistent with the pressure recommended by the valve manufacturer.

(continued)

CLINTON B 3.4-21 Revision No. 10-7

S/RVs B 3.4.4 BASES SURVEILLANCE SR 3.4.4.3 (continued)

REQUIREMENTS

2. The sample population of S/RVs tested to satisfy SR 3.4.4.1 will also be stroked in the relief mode during "as-found" testing to verify proper operation of the S/RV. The successful performance of the test sample of S/RVs provides reasonable assurance that the remaining installed S/RVs will perform in a similar fashion. After the S/RVs are replaced, the relief-mode actuator of the newly-installed S/RVs will be uncoupled from the S/RV stem, and cycled to ensure that no damage has occurred to the S/RV during transportation and installation. Following cycling, the relief-mode actuator is recoupled and the proper positioning of the stem nut is independently verified.

This verifies that each replaced S/RV will properly perform its intended function. If the valve fails to actuate due only to the failure of the solenoid but is capable of opening on overpressure, the safety function of the S/RV is considered OPERABLE.

The 24 month Frequency was developed based on the S/RV tests required by the ASME Boiler and Pressure Vessel Code, Section XI (Ref. 1). Operating experience has shown that these components usually pass the Surveillance. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

REFERENCES 1. ASME, Boiler and Pressure Vessel Code, Section III and XI.

2. USAR, Section 5.2.2.

3. USAR, Section 15.

4. NEDC-32202P, "SRV Setpoint Tolerance and Out-of-Service Analysis for Clinton Power Station, "August 1993."

5. Calculation IP-0-0032.

6. ASME/ANSI OM-1987, Operation and Maintenance of Nuclear Power Plants, Part 1.

CLINTON B 3.4-22 Revision No. 10-7

RCS Leakage Detection Instrumentation B 3.4.7 BASES ACTIONS A.1 (continued) continue for 30 days. The 30 day Completion Time of Required Action A.1 is acceptable, based on operating experience, considering the multiple forms of leakage detection that are still available.

B.1 With both gaseous and particulate drywell atmospheric monitoring channels inoperable, grab samples of the drywell atmosphere shall be taken and analyzed to provide periodic leakage information. Provided a sample is obtained and analyzed every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , the plant may continue operation since at least one other form of drywell leakage detection (i.e., air cooler condensate flow rate monitor) is available. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months interval provides periodic information that is adequate to detect LEAKAGE.

C.A With the required drywell air cooler condensate flow rate monitoring system inoperable, SR 3.4.7.1 is performed every 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months to provide periodic information of activity in the drywell at a more frequent interval than the routine Frequency of SR 3.4.7.1. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months interval provides periodic information that is adequate to detect LEAKAGE and recognizes that other forms of leakage detection are available. However, this Required Action is modified by a Note that allows this action to be not applicable if the required drywell atmospheric monitoring system is inoperable. Consistent with SR 3.0.1, Surveillances are not required to be performed on inoperable equipment.

(continued)

CLINTON B 3.4-36 Revision No. 10-3

RCS Leakage Detection Instrumentation B 3.4.7 BASES ACTIONS D.1 and D.2 (continued)

With both the gaseous and particulate drywell atmospheric monitor channels and the drywell air cooler condensate flow rate monitor inoperable, the only means of detecting LEAKAGE is the drywell floor drain sump monitoring system. This Condition does not provide the required diverse means of leakage detection. The Required Action is to restore either of the inoperable monitoring systems to OPERABLE status within 30 days to regain the intended leakage detection diversity. The 30 day Completion Time ensures that the plant will not be operated in a degraded configuration for a lengthy time period.

E.1 and E.2 If any Required Action of Condition A, B, C, or D cannot be met within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions in an orderly manner and without challenging plant systems.

F.1 With all required monitors inoperable, no required automatic means of monitoring LEAKAGE are available, and immediate plant shutdown in accordance with LCO 3.0.3 is required.

SURVEILLANCE SR 3.4.7.1 REQUIREMENTS This SR requires the performance of a CHANNEL CHECK of the required drywell atmospheric monitoring system. The check (continued)

CLINTON B 3.4-37 Revision No. 10-3

RCS Leakage Detection Instrumentation B 3.4.7 BASES SURVEILLANCE SR 3.4.7.1 (continued)

REQUIREMENTS gives reasonable confidence that the channel is operating properly. The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is based on instrument reliability and is reasonable for detecting off normal conditions.

SR 3.4.7.2 This SR requires the performance of a CHANNEL FUNCTIONAL TEST of the required RCS leakage detection instrumentation. The test ensures that the monitors can perform their function in the desired manner. The test also verifies the relative accuracy of the instrumentation. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The Frequency of 31 days considers instrument reliability, and operating experience has shown it proper for detecting degradation.

SR 3.4.7.3 This SR requires the performance of a CHANNEL CALIBRATION of the required RCS leakage detection instrumentation channels.

The calibration verifies the accuracy of the instrumentation, including the instruments located inside the drywell. The Frequency of 24 months is a typical refueling cycle and considers channel reliability. Operating experience has proven this Frequency is acceptable.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 30.

2. Regulatory Guide 1.45.

3. USAR, Section 5.2.5.2.2.

4. GEAP-5620, "Failure Behavior in ASTM A106B Pipes Containing Axial Through-Wall Flaws," April 1968.

5. NUREG-75/067, "Investigation and Evaluation of Cracking in Austenitic Stainless Steel Piping of Boiling Water Reactor Plants," October 1975.

6. USAR, Section 5.2.5.5.3.

7. USAR, Section 5.2.5.9.

CLINTON B 3.4-38 Revision No. 10-7

RCS Specific Activity B 3.4.8 BASES ACTIONS A.1 and A.2 (continued)

A Note permits the use of the provisions of LCO 3.0.4.c.

This allowance permits entry into the applicable MODE(S) while relying on the ACTIONS. This allowance is acceptable due to the significant conservatism incorporated into the specific activity limit, the low probability of a limiting event while exceeding this limit, and the ability to restore transient specific activity excursions while the plant remains at, or proceeds to power operation.

B.1, B.2.1, B.2.2.1, and B.2.2.2 If the DOSE EQUIVALENT 1-131 cannot be restored to 5 0.2 gCi/gm within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months , or if at any time it is > 4.0 gCi/gm, it must be determined at least every 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and all the main steam lines must be isolated within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Isolating the main steam lines precludes the possibility of releasing radioactive material to the environment in an amount that is more than a small fraction of the requirements of 10 CFR 100 during a postulated MSLB accident.

Alternately, the plant can be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . This option is provided for those instances when isolation of main steam lines is not desired (e.g., due to the decay heat loads).

In MODE 4, the requirements of the LCO are no longer applicable.

The Completion Time of once every 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is based on the time needed to take and analyze a sample. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time is reasonable, based on operating experience, to isolate the main steam lines in an orderly manner and without challenging plant systems. Also, the allowed Completion Times for Required Actions B.2.2.1 and B.2.2.2 for bringing the plant to MODES 3 and 4 are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued)

CLINTON B 3.4-41 Revision No. 10-3

ECCS-Operating B 3.5.1 BASES (continued)

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable HPCS subsystem. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable HPCS subsystem and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

A.1 If any one low pressure ECCS injection/spray subsystem is inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this Condition, the remaining OPERABLE subsystems provide adequate core cooling during a LOCA. However, overall ECCS reliability is reduced because a single failure in one of the remaining OPERABLE subsystems concurrent with a LOCA may result in the ECCS not being able to perform its intended safety function. The 7 day Completion Time is based on a reliability study (Ref. 12) that evaluated the impact on ECCS availability by assuming that various components and subsystems were taken out of service. The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowed outage times (i.e., Completion Times).

B.1 and B.2 If the HPCS System is inoperable, and the RCIC System is verified to be OPERABLE (when RCIC is required to be OPERABLE), the HPCS System must be restored to OPERABLE status within 14 days. In this Condition, adequate core cooling is ensured by the OPERABILITY of the redundant and diverse low pressure ECCS injection/spray subsystems in conjunction with the ADS. Also, the RCIC System will automatically provide makeup water at most reactor operating pressures. Verification of RCIC OPERABILITY within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is therefore required when HPCS is inoperable and RCIC is required to be OPERABLE. This may be performed by an administrative check, by examining logs or other information, to determine if RCIC is out of service for maintenance or other reasons. It is not necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the RCIC System. However, if the OPERABILITY of the RCIC System cannot be verified and RCIC is required to be OPERABLE, Condition D must be immediately entered. If a single active component fails concurrent with a design basis LOCA, there is a potential, depending on the specific failure, that the minimum required ECCS equipment will not be available. A 14 day Completion Time is based on the results of a reliability study (Ref. 12) and has been found to be acceptable through operating experience.

(continued)

CLINTON B 3.5-6 Revision No. 10-3

ECCS-Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.4 (continued)

REQUIREMENTS The pump flow rates are verified with a pump differential pressure that is sufficient to overcome the RPV pressure expected during a LOCA. The pump outlet pressure is adequate to overcome the elevation head pressure between the pump suction and the vessel discharge, the piping friction losses, and RPV pressure present during LOCAs. These values may be established during pre-operational testing. The Frequency for this Surveillance is in accordance with the Inservice Testing Program requirements.

With regard to pump flow rates and differential pressures values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Refs. 17, 18, 19).

SR 3.5.1.5 The ECCS subsystems are required to actuate automatically to perform their design functions. This Surveillance test verifies that, with a required system initiation signal (actual or simulated), the automatic initiation logic of HPCS, LPCS, and LPCI will cause the systems or subsystems to operate as designed, including actuation of the system throughout its emergency operating sequence, automatic pump startup, and actuation of all automatic valves to their required positions. This Surveillance also ensures that the HPCS System will automatically restart on an RPV low water level (Level 2) signal received subsequent to an RPV high water level (Level 8) trip and that the suction is automatically transferred from the RCIC storage tank to the suppression pool. The LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1, "Emergency Core Cooling System (ECCS) Instrumentation," overlaps this Surveillance to provide complete testing of the assumed safety function.

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown that these components usually pass the SR, which is based on the refueling cycle.

Therefore, the Frequency (continued)

CLINTON B 3.5-11 Revision No. 10-7

ECCS-Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.5 (continued)

REQUIREMENTS was concluded to be acceptable from a reliability standpoint.

This SR is modified by a Note that excludes vessel injection/spray during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation through the test line, coolant injection into the RPV is not required during the Surveillance.

SR 3.5.1.6 The ADS designated S/RVs are required to actuate automatically upon receipt of specific initiation signals.

A system functional test is performed to demonstrate that the mechanical portions of the ADS function (i.e.,

solenoids) operate as designed when initiated either by an actual or simulated initiation signal, causing proper actuation of all the required components. SR 3.5.1.7 and the LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1 overlap this Surveillance to provide complete testing of the assumed safety function.

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown that these components usually pass the SR, which is based on the refueling cycle.

Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is modified by a Note that excludes valve actuation.

This prevents an RPV pressure blowdown.

SR 3.5.1.7 A manual actuation of each required ADS valve (those valves removed and replaced to satisfy SR 3.4.4.1) is performed to verify that the valve is functioning properly. This SR can be demonstrated by one of two methods. If performed by Method 1, plant startup is allowed prior to performing this test because valve OPERABILITY and the setpoints for overpressure protection are verified, per ASME requirements (Ref. 21), prior to valve installation. Therefore, this SR is modified by a Note that states the Surveillance is not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reactor steam pressure and flow are adequate to perform the test. The 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed for manual actuation after the required pressure is reached is sufficient to achieve stable (continued)

CLINTON B 3.5-12 Revision No. 10-7

ECCS-Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.8 REQUIREMENTS (continued)

This SR ensures that the ECCS RESPONSE TIMES are within limits for each of the ECCS injection and spray subsystems.

The response time limits (i.e., <42 seconds for the LPCI subsystems, <41 seconds for the LPCS subsystem, and <27 seconds for the HPCS system) are specified in applicable surveillance test procedures. This SR is modified by a Note which identifies that the associated ECCS actuation instrumentation is not required to be response time tested.

This is supported by Reference 15.

Response time testing of the remaining subsystem components is required. However, of the remaining subsystem components, the time for each ECCS pump to reach rated speed is not directly measured in the response time tests. The time(s) for the ECCS pumps to reach rated speed is bounded, in all cases, by the time(s) for the ECCS injection valve(s) to reach the full-open position. Plant-specific calculations show that all ECCS motor start times at rated voltage are less than two seconds. In addition, these calculations show that under degraded voltage conditions, the time to rated speed is less than five seconds.

ECCS RESPONSE TIME tests are conducted every 24 months. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown that these components usually pass the SR, which is based on the refueling cycle.

Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

With regard to ECCS RESPONSE TIME values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 20).

(continued)

CLINTON B 3.5-14 Revision No. 10-7

RCIC System B 3.5.3 BASES BACKGROUND The RCIC pump is provided with a minimum flow bypass line, (continued) which discharges to the suppression pool. The valve in this line automatically opens to prevent pump damage due to overheating when other discharge line valves are closed. To ensure rapid delivery of water to the RPV and to minimize water hammer effects, the RCIC System discharge line "keep fill" system is designed to maintain the pump discharge line filled with water.

APPLICABLE The function of the RCIC System is to respond to transient SAFETY ANALYSES events by providing makeup coolant to the reactor. Should a design basis control rod drop accident occur, the RCIC System can be used in conjunction with the HPCS System to meet the single failure criteria in mitigating the consequences of the event (Ref. 4). The RCIC System is an Engineered Safety Feature for this event and satisfies Criterion 3 of the NRC Policy Statement.

LCO The OPERABILITY of the RCIC System provides adequate core cooling such that actuation of any of the ECCS subsystems is not required in the event of RPV isolation accompanied by a loss of feedwater flow. The RCIC System has sufficient capacity to maintain RPV inventory during an isolation event.

APPLICABILITY The RCIC System is required to be OPERABLE in MODE 1, and MODES 2 and 3 with reactor steam dome pressure > 150 psig since RCIC is the primary non-ECCS water source for core cooling when the reactor is isolated and pressurized. In MODES 2 and 3 with reactor steam dome pressure

150 psig, and in MODES 4 and 5, RCIC is not required to be OPERABLE since the ECCS injection/spray subsystems can provide sufficient flow to the vessel.

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable RCIC system. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable RCIC system and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

(continued)

CLINTON B 3.5-22 Revision No. 10-3

RCIC System B 3.5.3 BASES ACTIONS A.1 and A.2 (continued)

If the RCIC System is inoperable during MODE 1, or MODES 2 or 3 with reactor steam dome pressure > 150 psig, and the HPCS System is verified to be OPERABLE, the RCIC System must be restored to OPERABLE status within 14 days. In this Condition, loss of the RCIC System will not affect the overall plant capability to provide makeup inventory at high RPV pressure since the HPCS System is the only high pressure system assumed to function during a loss of coolant accident (LOCA). OPERABILITY of the HPCS is therefore verified within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months when the RCIC System is inoperable. This may be performed as an administrative check, by examining logs or other information, to determine if the HPCS is out of service for maintenance or other reasons. Verification does not require performing the Surveillances needed to demonstrate the OPERABILITY of the HPCS System. If the OPERABILITY of the HPCS System cannot be verified, however, Condition B must be immediately entered. For transients and certain abnormal events with no LOCA, RCIC (as opposed to HPCS) is the preferred source of makeup coolant because of its relatively small capacity, which allows easier control of RPV water level. Therefore, a limited time is allowed to restore the inoperable RCIC to OPERABLE status.

The 14 day Completion Time is based on a reliability study (Ref. 3) that evaluated the impact on ECCS availability, assuming that various components and subsystems were taken out of service. The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowed outage times (AOTs). Because of the similar functions of the HPCS and RCIC, the AOTs (i.e., Completion Times) determined for the HPCS are also applied to RCIC.

B.1 and B.2 If the RCIC System cannot be restored to OPERABLE status within the associated Completion Time, or if the HPCS System is simultaneously inoperable, the plant must be brought to a condition in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and reactor steam dome pressure reduced to 5 150 psig within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued)

CLINTON B 3.5-23 Revision No. 10-3

RCIC System B 3.5.3 BASES SURVEILLANCE SR 3.5.3.3 and SR 3.5.3.4 REQUIREMENTS (continued) The RCIC pump flow rates ensure that the system can maintain reactor coolant inventory during pressurized conditions with the RPV isolated. The flow tests for the RCIC System are performed at two different pressure ranges such that system capability to provide rated flow is tested both at the higher and lower operating ranges of the system.

Additionally, adequate steam flow must be passing through the main turbine or turbine bypass valves to continue to control reactor pressure when the RCIC System diverts steam flow. Since the required reactor steam pressure must be available to perform SR 3.5.3.3 and SR 3.5.3.4, sufficient time is allowed after adequate pressure and flow are achieved to perform these SRs. Reactor startup is allowed prior to performing the low pressure Surveillance because the reactor pressure is low and the time to satisfactorily perform the Surveillance is short. The reactor pressure is allowed to be increased to normal operating pressure since it is assumed that the low pressure test has been satisfactorily completed and there is no indication or reason to believe that RCIC is inoperable. Therefore, these SRs are modified by Notes that state the Surveillances are not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the reactor steam pressure and flow are adequate to perform the test.

A 92 day Frequency for SR 3.5.3.3 is consistent with the Inservice Testing Program requirements. The 24 month Frequency for SR 3.5.3.4 is based on the need to perform this Surveillance under the conditions that apply just prior to or during startup from a plant outage. Operating experience has shown that these components usually pass the SR, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

With regard to RCIC steam supply pressure values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 5).

With regard to the measured reactor pressure and flow rate values obtained pursuant to SR 3.5.3.3, as read from plant instrumentation assumed in Reference 5, are considered to be nominal values and therefore do not require compensation for instrument indication uncertainties.

With regard to the measured reactor pressure and flow rate values obtained pursuant to SR 3.5.3.4, the values as read from plant indication instrumentation are not considered to be nominal values with respect to instrument uncertainties. This requires additional margin to be added to the limit to compensate for instrument uncertainties, for implementation in the associated plant procedures (Ref. 5).

(continued)

CLINTON B 3.5-25 Revision No. 10-7

RCIC System B 3.5.3 BASES SURVEILLANCE SR 3.5.3.5 REQUIREMENTS (continued) The RCIC System is required to actuate automatically to I perform its design function. This Surveillance verifies that with a required system initiation signal (actual or simulated) the automatic initiation logic of RCIC will cause the system to operate as designed, including actuation of the system throughout its emergency operating sequence, automatic pump startup and actuation of all automatic valves to their required positions. This Surveillance test also ensures that the RCIC System will automatically restart on an RPV low water level (Level 2) signal received subsequent to an RPV high water level (Level 8) trip and that the suction is automatically transferred from the RCIC storage tank to the suppression pool. The LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.2, "Reactor Core Isolation Cooling (RCIC) System Instrumentation," overlaps this Surveillance to provide complete testing of the assumed safety function.

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant J

outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown that these components usually I pass the SR, which is based on the refueling cycle.

Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is modified by a Note that excludes vessel injection during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation through the test line, coolant injection into the RPV is not required during the Surveillance.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 33.

2. USAR, Section 5.4.6.

3. Memorandum from R.L. Baer (NRC) to V. Stello, Jr.

(NRC), "Recommended Interim Revisions to LCO's for ECCS Components," December 1, 1975.

4. USAR, Section 15.4.9.

5. Calculation 01RI15.

CLINTON B 3.5-26 Revision No. 10-7

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.4 (continued)

REQUIREMENTS in a time period less than or equal to that assumed in the safety analysis. The isolation time and Frequency of this SR are in accordance with the Inservice Testing Program.

With regard to isolation time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 8).

SR 3.6.1.3.5 For primary containment purge valves with resilient seals, additional leakage rate testing beyond the test requirements of the Primary Containment Leakage Rate Testing Program is required to ensure OPERABILITY. The acceptance criterion for this test is 5 0.02 La for each penetration when pressurized to Pa, 9.0 psig. Since cycling these valves may introduce additional seal degradation (beyond that which occurs to a valve that has not been opened), this SR must be performed within 92 days after opening the valve. However, operating experience has demonstrated that if a valve with a resilient seal is not stroked during an operating cycle, significant increased leakage through the valve is not observed. Based on this observation, a normal Frequency in accordance with the Primary Containment Leakage Rate Testing Program was established.

The SR is modified by a Note stating that the primary containment purge valves are only required to meet leakage rate testing requirements in MODES 1, 2, and 3. If a LOCA inside primary containment occurs in these MODES, purge valve leakage must be minimized to ensure offsite radiological release is within limits. At other times when the purge valves are required to be capable of closing (e.g., during handling of recently irradiated fuel),

pressurization concerns are not present and the purge valves are not required to meet any specific leakage criteria.

With regard to leakage rate values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 9).

Dose associated with leakage through the primary containment purge lines is considered to be in addition to that controlled as part of the primary containment leakage rate limit, La, and the 0.08 La limit for the other secondary containment bypass leakage paths.

(continued)

CLINTON B 3.6-25 Revision No. 10-5

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.6 REQUIREMENTS (continued) Verifying that the full closure isolation time of each MSIV is within the specified limits is required to demonstrate OPERABILITY. The full closure isolation time test ensures that the MSIV will isolate in a time period that does not exceed the times assumed in the DBA analyses. The Frequency of this SR is in accordance with the Inservice Testing Program.

With regard to isolation time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 10).

SR 3.6.1.3.7 Automatic PCIVs close on a primary containment isolation signal to prevent leakage of radioactive material from primary containment following a DBA. This SR ensures that each automatic PCIV will actuate to its isolation position on a primary containment isolation signal. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.1.6 overlaps this SR to provide complete testing of the safety function. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass this Surveillance. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 3.6.1.3.8 This SR ensures that the leakage rate of secondary containment bypass leakage paths is less than the specified leakage rate. This provides assurance that the assumptions in the radiological evaluations of References 1, 2, and 3 are met. The leakage rate of each bypass leakage path is assumed to be the maximum pathway leakage (leakage through the worse of the two isolation valves) unless the penetration is isolated by use of one closed and de-activated automatic valve, closed manual valve, or blind flange. In this case, the leakage rate of the isolated bypass leakage path is assumed to be the actual pathway (continued)

CLINTON B 3.6-26 Revision No. 10-7

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.11 REQUIREMENTS (continued) This SR ensures that the combined leakage rate of the primary containment feedwater penetrations is less than the specified leakage rate. The leakage rate is based on water as the test medium since these penetrations are designed to be sealed by the FWLCS. The 2 gpm leakage limit has been shown by testing and analysis to bound the condition following a DBA LOCA where, for a limited time, both air and water are postulated to leak through this pathway. The leakage rate of each primary containment feedwater penetration is assumed to be the maximum pathway leakage, i.e., the leakage through the worst of the two isolation valves [either 1B21-F032A(B) or IB21-F065A(B)] in each penetration. This provides assurance that the assumptions in the radiological evaluations of References 1 and 2 are met (Ref. 15).

Dose associated with leakage (both air and water) through the primary containment feedwater penetrations is considered to be in addition to the dose associated with all other secondary containment bypass leakage paths.

The Frequency is in accordance with the Primary Containment Leakage Rate Testing Program.

A Note is added to this SR which states that the primary containment feedwater penetrations are only required to meet this leakage limit in Modes 1, 2, and 3. In other conditions, the Reactor Coolant System is not pressurized and specific primary containment leakage limits are not required.

SR 3.6.1.3.12 This SR requires a demonstration that each instrumentation line excess flow check valve (EFCV) which communicates to the reactor coolant pressure boundary (Ref. 16) is OPERABLE by verifying that the valve activates within the required flow range. For instrument lines connected to reactor coolant pressure boundary, the EFCVs serve as an additional flow restrictor to the orifices that are installed inside the drywell (Ref. 14). The 24 month Frequency is based on I the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

(continued)

CLINTON B 3.6-28a Revision No. 10-7

LLS Valves B 3.6.1.6 BASES SURVEILLANCE SR 3.6.1.6.1 (continued)

REQUIREMENTS proper positioning of the stem nut is independently verified. This verifies that each replaced S/RV will properly perform its intended function.

The Frequency of the required relief-mode actuator testing is based on the tests required by ASME OM Part 1 (Ref. 2),

as implemented by the Inservice Testing Program of Specification 5.5.6. The testing Frequency required by the Inservice Testing Program is based on operating experience and valve performance. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 3.6.1.6.2 The LLS designed S/RVs are required to actuate automatically upon receipt of specific initiation signals. A system functional test is performed to verify that the mechanical portions (i.e., solenoids) of the automatic LLS function operate as designed when initiated either by an actual or simulated automatic initiation signal. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.5.4 overlaps this SR to provide complete testing of the safety function.

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown these components usually pass the Surveillance. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is modified by a Note that excludes valve actuation.

This prevents a reactor pressure vessel pressure blowdown.

REFERENCES 1. USAR, Section 5.2.2.2.3.

2. ASME/ANSI OM-1987, Operation and Maintenance of Nuclear Power Plants, Part 1.

CLINTON B 3.6-38 Revision No. 10-7

RHR Containment Spray System B 3.6.1.7 BASES SURVEILLANCE SR 3.6.1.7.1 (continued)

REQUIREMENTS A Note has been added to this SR that allows RHR containment spray subsystems to be considered OPERABLE during alignment to and operation in the RHR shutdown cooling mode when below the RHR cut in permissive pressure in MODE 3, if capable of being manually realigned and not otherwise inoperable. At these low pressures and decay heat levels (the reactor is shut down in MODE 3), a reduced complement of subsystems should provide the required containment pressure mitigation function thereby allowing operation of an RHR shutdown cooling loop when necessary.

SR 3.6.1.7.2 Verifying each RHR pump develops a flow rate 2 3800 gpm while operating in the suppression pool cooling mode with flow through the associated heat exchanger ensures that pump performance has not degraded below the required flow rate during the cycle. It is tested in the pool cooling mode to demonstrate pump OPERABILITY without spraying down equipment in primary containment. Although this SR is satisfied by running the pump in the suppression pool cooling mode, the test procedures that satisfy this SR include appropriate acceptance criteria to account for the higher pressure requirements resulting from aligning the RHR System in the containment spray mode. The Frequency of this SR is in accordance with the Inservice Testing Program.

SR 3.6.1.7.3 This SR verifies that each RHR containment spray subsystem automatic valve actuates to its correct position upon receipt of an actual or simulated automatic actuation signal. Actual spray initiation is not required to meet this SR. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.3.5 overlaps this SR to provide complete testing of the safety function. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillance.

(continued)

CLINTON B 3.6-42 Revision No. 10-7

RHR Containment Spray System B 3.6.1.7 BASES SURVEILLANCE SR 3.6.1.7.3 (continued)

REQUIREMENTS Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 3.6.1.7.4 This Surveillance is performed following activites that could result in nozzle blockage to verify that the spray nozzles are not obstructed and that flow will be provided when required. Such activities may include a loss of foreign material control (of if it cannot be assured),

following a major configuration change, or following an inadvertent actuation of containment spray. This Surveillance is normally performed by an air or smoke flow test. The Frequency is adequate due to the passive nozzle design and its normally dry state and has been shown to be acceptable through operating experience.

REFERENCES 1. USAR, Section 6.2.1.1.5.

2. ASME, Boiler and Pressure Vessel Code, Section XI.

3. USAR, Section 5.4.7 CLINTON B 3.6-43 Revision No. 10-7

I B 3.6 CONTAINMENT SYSTEMS B 3.6.1.8 Deleted CLINTON B 3. 6-44 Revision No. 10-5

This Page Left Intentionally Blank CLINTON B 3.6-45 Revision No. 10-5

This Page Left Intentionally Blank CLINTON B 3.6-46 Revision No. 10-5

This Page Left Intentionally Blank CLINTON B 3.6-47 Revision No. 10-5

SPMU System B 3.6.2.4 BASES SURVEILLANCE SR 3.6.2.4.3 (continued)

REQUIREMENTS The Frequency of 31 days is justified because the valves are operated under procedural control and because improper valve position would affect only a single subsystem. This Frequency has been shown to be acceptable through operating experience.

SR 3.6.2.4.4 This SR requires a verification that each SPMU subsystem automatic valve actuates to its correct position on receipt of an actual or simulated automatic initiation signal. This includes verification of the correct automatic positioning of the valves and of the operation of each interlock and timer. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.4.7 overlaps this SR to provide complete testing of the safety function. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass the Surveillance. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is modified by a Note that excludes make up to the suppression pool. Since all active components are testable, makeup to the suppression pool is not required.

REFERENCES 1. USAR, Section 6.2.

2. USAR, Chapter 15.

3. USAR, Section 6.2.7.

4. Calculation IP-0-0074.

5. Calculation IP-0-0075.

6. Calculation IP-M-0662.

CLINTON B 3.6-65 Revision No. 10-7

B 3.6.3.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.3.1 Deleted CLINTON B 3.6-66 Revision No. 10-2

B 3.6.3.1 This page intentionally left blank CLINTON B 3.6-67 Revision No. 10-2

B 3.6.3.1 This page intentionally left blank CLINTON B 3.6-68 Revision No. 10-2

B 3.6.3.1 This page intentionally left blank CLINTON B 3.6-69 Revision No. 10-2

B 3.6.3.1 This page intentionally left blank CLINTON B 3.6-70 Revision No. 10-2

B 3.6.3.1 This page intentionally left blank CLINTON B 3.6-71 Revision No. 10-2

Primary Containment and Drywell Hydrogen Igniters B 3.6.3.2 BASES (continued)

APPLICABILITY In MODES 1 and 2, the hydrogen igniter is required to control hydrogen concentration to near the flammability limit of 4.0 v/o following a degraded core event that would generate hydrogen in amounts equivalent to a metal water reaction of 75% of the core cladding. The control of hydrogen concentration prevents overpressurization of the primary containment. The event that could generate hydrogen in quantities sufficiently high enough to exceed the flammability limit is limited to MODES 1 and 2.

In MODE 3, both the hydrogen production rate and the total hydrogen produced after a degraded core accident would be less than that calculated for the DBA LOCA. Also, because of the limited time in this MODE, the probability of an accident requiring the hydrogen igniter is low. Therefore, the hydrogen igniter is not required in MODE 3.

In MODES 4 and 5, the probability and consequences of a degraded core accident are reduced due to the pressure and temperature limitations. Therefore, the hydrogen igniters are not required to be OPERABLE in MODES 4 and 5 to control hydrogen.

ACTIONS A. 1 With one hydrogen igniter division inoperable, the inoperable division must be restored to OPERABLE status within 30 days. In this Condition, the remaining OPERABLE hydrogen igniter division is adequate to perform the hydrogen burn function. However, the overall reliability is reduced because a single failure in the OPERABLE subsystem could result in reduced hydrogen control capability. The 30 day Completion Time is based on the low probability of the occurrence of a degraded core event that would generate hydrogen in amounts equivalent to a metal water reaction of 75% of the core cladding, the amount of time available after the event for operator action to prevent hydrogen accumulation from exceeding the flammability limit, and the low probability of failure of the OPERABLE hydrogen igniter division.

I (continued)

CLINTON B 3.6-74 Revision No. 10-3

Primary Containment and Drywell Hydrogen Igniters B 3.6.3.2 BASES ACTIONS B.1 and B.2 (continued)

With two primary containment and drywell igniter hydrogen divisions inoperable, the ability to perform the hydrogen control function via alternate capabilities must be verified by administrative means within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The alternate hydrogen control capabilities are provided by at least one hydrogen recombiner in conjunction with one Containment/

Drywell Hydrogen Mixing System and two drywell post-LOCA vacuum relief subsystems. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time allows a reasonable period of time to verify that a loss of hydrogen control function does not exist. The verification may be performed as an administrative check by examining logs or other information to determine the availability of the alternate hydrogen control capabilities. It does not mean to perform the Surveillances needed to demonstrate OPERABILITY of the alternate hydrogen control capabilities.

If the ability to perform the hydrogen control function is maintained, continued operation is permitted with two igniter divisions inoperable for up to 7 days. Seven days is a reasonable time to allow two igniter divisions to be inoperable because the hydrogen control function is maintained and because of the low probability of the occurrence of a LOCA that would generate hydrogen in the amounts capable of exceeding the flammability limit.

C.1 If any Required Action and required Completion Time cannot be met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

(continued)

CLINTON B 3.6-75 Revision No. 10-3

Primary Containment and Drywell Hydrogen Igniters B 3.6.3.2 BASES SURVEILLANCE SR 3.6.3.2.1 and SR 3.6.3.2.2 REQUIREMENTS These SRs verify that there are no physical problems that could affect the igniter operation. Since the igniters are mechanically passive, they are not subject to mechanical failure. The only credible failures are loss of power or burnout. The verification that each required igniter is energized is performed by circuit current versus voltage measurement.

The Frequency of 184 days has been shown to be acceptable through operating experience because of the low failure occurrence, and provides assurance that hydrogen burn capability exists between the more rigorous 24 month Surveillances. Operating experience has shown these components usually pass the Surveillance when performed at a 184 day Frequency. Additionally, these surveillances must be performed every 92 days if four or more igniters in any division are inoperable. The 92 day Frequency was chosen, recognizing that the failure occurrence is higher than normal. Thus, decreasing the Frequency from 184 days to 92 days is a prudent measure, since only two more inoperable igniters (for a total of six) will result in an inoperable igniter division. SR 3.6.3.2.2 is modified by a Note that indicates that the Surveillance is not required to be performed until 92 days after four or more igniters in the division are discovered to be inoperable.

With regard to circuit current and voltage values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 4).

(continued)

CLINTON B 3.6-76 Revision No. 10-7

Primary Containment and Drywell Hydrogen Igniters B 3.6.3.2 BASES I SURVEILLANCE SR 3.6.3.2.3 and SR 3.6.3.2.4 REQUIREMENTS (continued) These functional tests are performed every 24 months to verify system OPERABILITY. The current draw to develop a surface temperature of Z 1700'F is verified for igniters in inaccessible areas, e.g., in a high radiation area.

Additionally, the surface temperature of each accessible igniter is measured to be Ž 1700OF to demonstrate that a temperature sufficient for ignition is achieved. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown that these components usually pass the Surveillance. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

With regard to current draw and surface temperature values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 4).

REFERENCES 1. 10 CFR 50.44.

2. 10 CFR 50, Appendix A, GDC 41.

3. USAR, Section 6.2.5.

4. Calculation IP-0-0076.

CLINTON B 3. 6-77 Revision No. 10-7

Containment/Drywell Hydrogen Mixing System B 3.6.3.3 BASES APPLICABILITY calculated for the DBA LOCA. Also, because of the limited (continued) time in this MODE, the probability of an accident requiring the Containment/Drywell Hydrogen Mixing System is low.

Therefore, the Containment/Drywell Hydrogen Mixing System is not required in MODE 3.

In MODES 4 and 5, the probability and consequences of a LOCA are reduced due to the pressure and temperature limitations in these MODES. Therefore, the Containment/Drywell Hydrogen Mixing System is not required in these MODES.

ACTIONS A.1 With one Containment/Drywell Hydrogen Mixing System inoperable, the inoperable system must be restored to OPERABLE status within 30 days. In this condition, the remaining OPERABLE system is adequate to perform the hydrogen mixing function. However, the overall reliability is reduced because a single failure in the OPERABLE system could result in reduced hydrogen mixing capability. The 30 day Completion Time is based on the low probability of failure of the OPERABLE Containment/Drywell Hydrogen Mixing system, the low probability of a LOCA that would generate hydrogen in amounts capable of exceeding the flammability limit, and the amount of time available after the event for operator action to prevent hydrogen accumulation from exceeding this limit.

I B.1 and B.2 With two Containment/Drywell Hydrogen Mixing Systems inoperable, the ability to perform the hydrogen control function via alternate capabilities must be verified by administrative means within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The alternate hydrogen control capabilities are provided by one division of the hydrogen igniters. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time allows a (continued)

CLINTON B 3.6-80 Revision No. 10-3

Containment/Drywell Hydrogen Mixing System B 3.6.3.3 BASES SURVEILLANCE SR 3.6.3.3.2 REQUIREMENTS (continued) Verifying that each Containment/Drywell Hydrogen Mixing System flow rate is Ž 800 scfm ensures that each system is capable of maintaining drywell hydrogen concentrations below the flammability limit. In practice, verifying that the system differential pressure is less than 4.4 psid with the compressor running ensures that the system flow rate is greater than 800 scfm. Operating experience has shown that these components usually pass the Surveillance. Therefore, I the Frequency was concluded to be acceptable from a reliability standpoint.

With regard to system differential pressure values used to verify the required system flow rate as read from plant indication instrumentation, the procedural limit is considered to be not nominal and therefore requires compensation for instrument indication uncertainties (Ref.

3).

REFERENCES 1. Regulatory Guide 1.7.

2. USAR, Section 6.2.5.

3. Calculation IP-0-0076.

CLINTON B 3.6-82 Revision No. 10-7

Secondary Containment B 3.6.4.1 BASES SURVEILLANCE SR 3.6.4.1.4 and SR 3.6.4.1.5 REQUIREMENTS (continued) The SGT System exhausts the secondary containment atmosphere to the environment through appropriate treatment equipment.

To ensure that all fission products are treated, SR 3.6.4.1.4 verifies that the SGT System will rapidly establish and maintain a pressure in the secondary containment that is less than the lowest postulated pressure external to the secondary containment boundary. This is confirmed by demonstrating that one SGT subsystem will draw down the secondary containment to Ž 0.25 inches of vacuum water gauge within the required time.

Specifically, the required drawdown time limit is based on ensuring that the SGT system will draw down the secondary containment pressure to Ž 0.25 inches of vacuum water gauge within 12 minutes (i.e., 10 minutes from start of gap release which occurs 2 minutes after LOCA initiation) under LOCA conditions. Typically, however, the conditions under which drawdown testing is performed pursuant to SR 3.6.4.1.4 are different than those assumed for LOCA conditions. For this reason, and because test results are dependent on or influenced by certain plant and/or atmospheric conditions that may be in effect at the time testing is performed, it is necessary to adjust the test acceptance criteria (i.e.,

the required drawdown time) to account for such test conditions. Conditions or factors that may impact the test results include wind speed, whether the turbine building ventilation system is running, and whether the containment equipment hatch is open (when the test is performed during plant shutdown/outage conditions). The acceptance criteria for the drawdown test are thus based on a computer model (Ref. 6), verified by actual performance of drawdown tests, in which the drawdown time determined for accident conditions is adjusted to account for performance of the test during normal but certain plant conditions. The test acceptance criteria are specified in the applicable plant test procedure(s). Since the drawdown time is dependent upon secondary containment integrity, the drawdown requirement cannot be met if the secondary containment boundary is not intact.

SR 3.6.4.1.5 demonstrates that each SGT subsystem can maintain Ž 0.25 inches of vacuum water gauge for 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months at a flow rate

4400 acfm. The 1-hour test period allows secondary containment to be in thermal equilibrium at steady state conditions. Therefore, the tests required per SR 3.6.4.1.4 and SR 3.6.4.1.5 are performed to ensure secondary containment boundary integrity. Since these SRs are secondary containment tests, they need not be performed with each SGT subsystem and an inoperable SGT subsystem does not result in this SR being not met. The SGT subsystems are tested on a STAGGERED TEST BASIS, however, to ensure that in addition to the requirements of LCO 3.6.4.3, either SGT subsystem will perform this test. Operating experience has (continued)

CLINTON B 3.6-88 Revision No. 10-5

Secondary Containment B 3.6.4.1 BASES SURVEILLANCE SR 3.6.4.1.4 and SR 3.6.4.1.5 (continued)

REQUIREMENTS shown these components usually pass the Surveillance. I Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

With regard to drawdown time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Refs. 4, 5).

REFERENCES 1. USAR, Section 15.6.5.

2. USAR, Section 15.7.4.

3. Calculation IP-0-0082.

4. Calculation IP-0-0083.

5. Calculation IP-0-0084.

6. Calculation 3C10-1079-001.

CLINTON B 3.6-88a Revision No. 10-7

SCIDs B 3.6.4.2 BASES SURVEILLANCE SR 3.6.4.2.3 REQUIREMENTS (continued) Verifying that each automatic SCID closes on a secondary containment isolation signal is required to prevent leakage l

of radioactive material from secondary containment following a DBA or other accident. This SR ensures that each automatic SCID will actuate to the isolation position on a secondary containment isolation signal. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.2.5 overlaps this SR to provide I complete testing of the safety function. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown these components usually pass the Surveillance. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

I REFERENCES 1. USAR, Section 15.6.5.

2. USAR, Section 6.2.3.

3. USAR, Section 15.7.4.

4. Calculation IP-0-0085.

CLINTON B 3.6-95 Revision No. 10-7

SGT System B 3.6.4.3 BASES ACTIONS E.1 and E.2 (continued) position. Also, if applicable, actions must be immediately initiated to suspend OPDRVs to minimize the probability of a vessel draindown and subsequent potential for fission product release. Action must continue until OPDRVs are suspended.

SURVEILLANCE SR 3.6.4.3.1 REQUIREMENTS Operating each SGT subsystem from the main control room for

> 10 continuous hours ensures that both subsystems are OPERABLE and that all associated controls are functioning properly. It also ensures that blockage, fan or motor failure, or excessive vibration can be detected for corrective action. Operation with the heaters on (automatic heater cycling to maintain temperature) for > 10 continuous hours every 31 days eliminates moisture on the adsorbers and HEPA filters. The 31 day Frequency was developed in consideration of the known reliability of fan motors and controls and the redundancy available in the system.

With regard to operating time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 9).

SR 3.6.4.3.2 This SR verifies that the required SGT filter testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The VFTP includes testing HEPA filter performance, charcoal adsorber bypass leakage and efficiency, minimum system flow rate, combined HEPA filter and charcoal adsorber pressure drop, and heater dissipation.

The frequencies for performing the SGT System filter tests are in accordance with Regulatory Guide 1.52 (Ref. 4) and include testing initially, after 720 hours0.00833 days 0.2 hours 0.00119 weeks 2.7396e-4 months of system operation, once per 24 months, and following painting, fire, or chemical release in any ventilation zone communicating with the system. The laboratory test results will be (continued)

CLINTON B 3.6-100 Revision No. 10-7

SGT System B 3.6.4.3 BASES SURVEILLANCE SR 3.6.4.3.2 (continued)

REQUIREMENTS verified to be within limits within 31 days of removal of the sample from the system. Additional information is discussed in detail in the VFTP.

With regard to filter testing values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 10).

SR 3.6.4.3.3 This SR requires verification that each SGT subsystem automatically starts upon receipt of an actual or simulated initiation signal.

The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.2.5 overlaps this SR to provide complete testing of the safety function.

While this Surveillance can be performed with the reactor at power, operating experience has shown these components usually pass the Surveillance, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 3.6.4.3.4 This SR requires verification that the SGT filter cooling bypass damper can be opened and the fan started. This ensures that the ventilation mode of SGT System operation is available. While this Surveillance can be performed with the reactor at power, operating experience has shown these components usually pass the Surveillance, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

(continued)

CLINTON B 3.6-101 Revision No. 10-7

Drywell Isolation Valves B 3.6.5.3 BASES SURVEILLANCE SR 3.6.5.3.5 REQUIREMENTS (continued) Verifying that each automatic drywell isolation valve closes on a drywell isolation signal is required to prevent bypass leakage from the drywell following a DBA. This SR ensures each automatic drywell isolation valve will actuate to its isolation position on a drywell isolation signal. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.1.6 overlaps this SR to provide complete testing of the safety function. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power, since isolation of penetrations would eliminate cooling water flow and disrupt the normal operation of many critical components. Operating experience has shown these components usually pass this Surveillance. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

REFERENCES 1. USAR, Section 6.2.4.

2. CPS ISI Manual.

3. Calculation IP-0-0091.

CLINTON B 3.6-121 Revision No. 10-7

Drywell Post-LOCA Vacuum Relief System B 3.6.5.6 BASES SURVEILLANCE SR 3.6.5.6.3 REQUIREMENTS (continued) Verification of the drywell post-LOCA vacuum relief valve opening differential pressure is necessary to ensure that the safety analysis assumptions of < 0.2 psid for drywell vacuum relief are valid. The safety analysis assumes that the drywell post-LOCA vacuum relief valves will start opening when the dry well pressure is approximately 0.2 psid less than the containment and will be fully open when this differential pressure is 0.5 psid. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for violating the drywell boundary. Operating experience has shown these components usually pass the Surveillance, which is based on the refueling cycle. I Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

REFERENCES 1. USAR, Section 6.2.

CLINTON B 3.6-132 Revision No. 10-7

Division 1 and 2 SX Subsystems and UHS B 3.7.1 BASES SURVEILLANCE SR 3.7.1.2 (continued)

REQUIREMENTS Isolation of the SX subsystem to components or systems does not necessarily affect the OPERABILITY of the associated SX subsystem. As such, when all SX pumps, valves, and piping are OPERABLE, but a branch connection off the main header is isolated, the associated SX subsystem needs to be evaluated to determine if it is still OPERABLE. Alternatively, it is acceptable and conservative to declare an SX subsystem inoperable when a branch connection is isolated or a supported ventilation system is inoperable.

The 31 day Frequency is based on engineering judgment, is consistent with the procedural controls governing valve operation, and ensures correct valve positions.

SR 3.7.1.3 This SR verifies that the automatic isolation valves of the Division 1 and 2 SX subsystems will automatically switch to the safety or emergency position to provide cooling water exclusively to the safety related equipment during an accident event. This is demonstrated by use of an actual or simulated initiation signal and is performed with the plant shut down. This SR also verifies the automatic start capability of the SX pump in each subsystem.

Operating experience has shown that these components usually pass the SR. Therefore, this Frequency is concluded to be acceptable from a reliability standpoint.

REFERENCES 1. Regulatory Guide 1.27, Revision 2, January 1976.

2. USAR, Section 9.2.1.2.

3. USAR, Table 9.2-3.

4. USAR, Section 6.2.1.1.3.3.

5. USAR, Chapter 15.

6. USAR, Section 6.2.2.3.

7. USAR, Table 6.2-2.

8. Calculation IP-0-0095.

CLINTON B 3.7-6 Revision No. 10-7

Division 3 SX Subsystem B 3.7.2 BASES SURVEILLANCE SR 3.7.2.1 (continued)

REQUIREMENTS Isolation of the Division 3 SX subsystem to components or systems does not necessarily affect the OPERABILITY of the Division 3 SX subsystem. As such, when the Division 3 SX pump, valves, and piping are OPERABLE, but a branch connection off the main header is isolated, the Division 3 SX subsystem needs to be evaluated to determine if it is still OPERABLE. Alternatively, it is acceptable and conservative to declare an SX subsystem inoperable when a branch connection is isolated or a supported ventilation system is inoperable.

The 31 day Frequency is based on engineering judgment, is consistent with the procedural controls governing valve operation, and ensures correct valve positions.

SR 3.7.2.2 This SR verifies that the automatic isolation valves of the Division 3 SX subsystem will automatically switch to the safety or emergency position to provide cooling water exclusively to the safety related equipment during an accident event. This is demonstrated by use of an actual or simulated initiation signal and is performed with the plant shut down. This SR also verifies the automatic start capability of the Division 3 SX pump.

Operating experience has shown that these components usually pass the SR. Therefore, this Frequency is concluded to be acceptable from a reliability standpoint.

REFERENCES 1. USAR, Section 9.2.1.2.

2. USAR, Chapter 6.

3. USAR, Chapter 15.

CLINTON B 3.7-9 Revision No. 10-7

Control Room Ventilation System B 3.7.3 BASES SURVEILLANCE SR 3.7.3.1 and SR 3.7.3.2 (continued)

REQUIREMENTS With regard to subsystem operation time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 8, 9).

SR 3.7.3.3 This SR verifies that the required Control Room Ventilation System testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The VFTP includes testing HEPA filter performance, charcoal adsorber bypass leakage and efficiency, minimum system flow rate (scfm), combined HEPA filter and charcoal adsorber pressure drop, and heater dissipation. The frequencies for performing the Control Room Ventilation System filter tests are in accordance with Regulatory Guide 1.52 (Ref. 4) and include testing initially, after 720 hours0.00833 days 0.2 hours 0.00119 weeks 2.7396e-4 months of system operation, once per 24 months, and following painting, fire, or chemical release in any ventilation zone communicating with the system. The laboratory test results will be verified to be within limits within 31 days of removal of the sample from the system. Additional information is discussed in detail in the VFTP.

With regard to filter testing parameter values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Refs. 10, 11).

SR 3.7.3.4 This SR verifies that each Control Room Ventilation subsystem starts and operates on an actual or simulated high radiation initiation signal. While this Surveillance can be performed with the reactor at power, operating experience has shown these components usually pass the Surveillance, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

(continued)

CLINTON B 3.7-15 Revision No. 10-7

Control Room Ventilation System B 3.7.3 BASES SURVEILLANCE SR 3.7.3.5 REQUIREMENTS (continued) This SR verifies the integrity of the negative pressure portions of the Control Room Ventilation System ductwork located outside the main control room habitability boundary between fan OVCO4CA(B) and isolation dampers OVCO3YA(B) inclusive and fire dampers OVCO42YA(E), OVCO42YB(F),

OVCO42YC(G), and OVCO42YD(H). In addition, the integrity of the recirculation filter housing flexible connection to fan OVCO3A(B) must be verified. This testing ensures that the inleakage through the negative pressure portion of the Control Room Ventilation System remains within the design basis accident analysis basis. This inleakage would be filtered by the Control Room Ventilation System recirculation filters. An additional allowance of 144 cfm of unfiltered inleakage is also considered in the design basis accident analysis. Operating experience has shown that these components usually pass the SR. Therefore, this I Frequency is concluded to be acceptable from a reliability standpoint.

With regard to inleakage values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is not considered to be a nominal value with respect to instrument uncertainties. This requires additional margin to be added to the limit to compensate for instrument uncertainties, for implementation in the associated plant procedures (Ref. 12).

SR 3.7.3.6 This SR verifies the integrity of the control room enclosure and the assumed inleakage rates of potentially contaminated air. The control room positive pressure, with respect to potentially contaminated adjacent areas, is periodically tested to verify proper function of the Control Room Ventilation System. During the high radiation mode of operation, the Control Room Ventilation System is designed to slightly pressurize the control room to ' 1/8 inches water gauge positive pressure with respect to adjacent areas to prevent unfiltered inleakage. The Control Room Ventilation System is designed to maintain this positive pressure at a flow rate of

3000 scfm to the control room in the high radiation mode. The Frequency of 24 months on a STAGGERED TEST BASIS is consistent with the refueling cycle and other filtration system SRs.

I With regard to control room positive pressure values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is not considered to be a nominal value with respect to instrument uncertainties.

This requires additional margin to be added to the limit to compensate for instrument uncertainties, (Ref. 13).

(continued)

CLINTON B 3.7-16 Revision No. 10-7

Control Room AC System B 3.7.4 BASES ACTIONS E.1, E.2, and E.3 (continued)

During movement of irradiated fuel assemblies in the primary or secondary containment, during CORE ALTERATIONS, or during OPDRVs, if the Required Action and associated Completion Time of Condition B is not met, action must be taken to immediately suspend activities that present a potential for releasing radioactivity that might require operation of the Control Room Ventilation System in the high radiation mode.

This places the unit in a condition that minimizes risk.

If applicable, CORE ALTERATIONS and handling of irradiated fuel in the primary and secondary containment must be suspended immediately. Suspension of these activities shall not preclude completion of movement of a component to a safe position. Also, if applicable, actions must be initiated immediately to suspend OPDRVs to minimize the probability of a vessel draindown and subsequent potential for fission product release. Actions must continue until the OPDRVs are suspended.

SURVEILLANCE SR 3.7.4.1 REQUIREMENTS This SR verifies that the heat removal capability of the system is sufficient to remove the control room heat load assumed in the safety analysis. The SR consists of a combination of testing and calculation. The 24 month Frequency is appropriate since significant degradation of the Control Room AC System is not expected over this time period.

With regard to heat removal capability values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 3).

REFERENCES 1. USAR, Section 6.4.

2. USAR, Section 9.4.1.

3. Calculation IP-0-0102.

CLINTON B 3.7-21 Revision No. 10-7

Main Turbine Bypass System B 3.7.6 BASES (continued)

SURVEILLANCE SR 3.7.6.1 REQUIREMENTS Cycling each main turbine bypass valve through one complete cycle of full travel demonstrates that the valves are mechanically OPERABLE and will function when required. The 31 day Frequency is based on engineering judgment, is consistent with the procedural controls governing valve operation, and ensures correct valve positions. Therefore, the Frequency is acceptable from a reliability standpoint.

SR 3.7.6.2 The Main Turbine Bypass System is required to actuate automatically to perform its design function. This SR demonstrates that, with the required system initiation signals, the valves will actuate to their required position.

The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and because of the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown the 24 month Frequency, which is based on the refueling cycle, is acceptable from a reliability standpoint.

SR 3.7.6.3 This SR ensures that the TURBINE BYPASS SYSTEM RESPONSE TIME is in compliance with the assumptions of the appropriate safety analysis. The response time limits (bypass valve begins to open in : 0.1 seconds and 80% of turbine bypass system capacity is established in 5 0.3 seconds) are specified in applicable surveillance test procedures. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and because of the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown the 24 month Frequency, which is based on the refueling cycle, is acceptable from a reliability standpoint.

With regard to TURBINE BYPASS SYSTEM RESPONSE TIME values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 3).

(continued)

CLINTON B 3.7-27 Revision No. 10-7

AC Sources -Operating B 3.8.1 BASES APPLICABILITY A Note has been added taking exception to the Applicability (continued) requirements for Division 3 sources, provided the HPCS System is declared inoperable. This exception is intended to allow declaring of the HPCS System inoperable either in lieu of declaring the Division 3 source inoperable, or at any time subsequent to entering ACTIONS for an inoperable Division 3 source. This exception is acceptable since, with the HPCS System inoperable and the associated ACTIONS entered, the Division 3 AC sources provide no additional assurance of meeting the above criteria.

AC power requirements for MODES 4 and 5 are covered in LCO 3.8.2, "AC Sources- Shutdown."

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable DG. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable DG and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

A.1 To ensure a highly reliable power source remains, it is necessary to verify the availability of the remaining offsite circuits on a more frequent basis. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in the Required Action not met. However, if a second circuit fails SR 3.8.1.1, the second offsite circuit is inoperable, and Condition C, for two offsite circuits inoperable, is entered.

A.2 According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition A for a period that should not exceed 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . With one offsite circuit inoperable, the reliability of the offsite system is degraded, and the potential for a loss of offsite power is increased, with attendant potential for a challenge to the plant safety systems. In this Condition, however, the remaining OPERABLE offsite circuit and DGs are adequate to supply electrical power to the onsite Class 1E distribution system.

The Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and the low probability of a DBA occurring during this period.

(continued)

CLINTON B 3.8-5 Revision No. 10-3

AC Sources -Operating B 3.8.1 BASES ACTIONS B.4 (continued)

In Condition B, the remaining OPERABLE DGs and offsite circuits are adequate to supply electrical power to the onsite Class 1E distribution system. Although Condition B applies to a single inoperable DG, several Completion Times are specified for this Condition.

The first Completion Time applies to an inoperable Division 3 DG. The 72-hour Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and the low probability of a DBA during this period. This Completion Time begins only "upon discovery of an inoperable Division 3 DG" and, as such, provides an exception to the normal "time zero" for beginning the allowed outage time "clock" (i.e., for beginning the clock for an inoperable Division 3 DG when Condition B may have already been entered for another equipment inoperability and is still in effect).

The second Completion Time (14 days) applies to an inoperable Division 1 or 2 DG and is a risk-informed allowed out-of-service time (AOT) based on a plant-specific risk analysis performed to establish this AOT for the Division 1 and 2 DGs.

The evaluation that supports this Completion Time considered both planned and unplanned DG outage time. Based on this evaluation, it is intended that use of the full, 14-day completion time would be limited to once per DG per cycle (24 months) to perform a planned DG overhaul.

To mitigate increased risk during the period beyond 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and up to 14 days, the following actions must be completed prior to exceeding 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months s:

verification that the RAT and ERAT are operable.

" Verification of the correct breakers alignment and indicated power availability for each offsite circuit.

The DG extended Completion Time will not be entered for scheduled maintenance purposes if severe weather conditions are expected.

Additional elective equipment maintenance or testing that requires the equipment to be removed from service will be evaluated and activities that yield unacceptable results will be avoided.

The condition of the offsite power supply and switchyard, including transmission lines and ring bus breakers, will be evaluated.

No elective maintenance will be scheduled within the switchyard that would challenge the RAT connection or offsite power availability.

(continued)

CLINTON B 3.8-9 Revision No. 10-7

AC Sources--Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.8 REQUIREMENTS (continued) Transfer of each 4.16 kV ESF bus power supply from the normal offsite circuit to the alternate offsite circuit I

demonstrates the OPERABILITY of the alternate circuit. The 24 month Frequency of the Surveillance is based on engineering judgment taking into consideration the plant conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

Operating experience has shown that these components usually pass the SR. Therefore, the Frequency was concluded to be I acceptable from a reliability standpoint.

This SR is modified by a Note. The reason for the Note is that, during operation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, plant safety systems. Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this surveillance, for which adequate documentation of the required performance is available; and

2) Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

SR 3.8.1.9 Each DG is provided with an engine overspeed trip to prevent damage to the engine. Recovery from the transient caused by the loss of a large load could cause diesel engine overspeed, which, if excessive, might result in a trip of the engine. This Surveillance demonstrates the DG load response characteristics and capability to reject a load equivalent to at least as large as the largest single load while maintaining a specified margin to the overspeed trip.

(continued)

CLINTON B 3.8-17 Revision No. 10-7

AC Sources -Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.9 (continued).

REQUIREMENTS The referenced load for DG 1A is the low pressure core spray pump; for DG IB, the residual heat removal (RHR) pump; and for DG IC the HPCS pump. The Shutdown Service Water (SX) pump values are not used as the largest load since the SX supplies cooling to the associated DG. If this load were to trip, it would result in the loss of the DG. The use of larger loads for reference purposes is acceptable. This Surveillance may be accomplished by:

1) Tripping the DG output breaker with the DG carrying greater than or equal to its associated single largest load while paralleled to offsite power, or while supplying the bus, or

2) Tripping its associated single largest load with the DG supplying the bus.

As required by IEEE-308 (Ref. 13), the load rejection test is acceptable if the increase in diesel speed does not exceed 75% of the difference between synchronous speed and the overspeed trip setpoint, or 15% above synchronous speed, whichever is lower.

The 24 month Frequency is consistent with the refuel cycle recommendations of Regulatory Guide 1.9 (Ref. 15).

This SR has been modified by two Notes. The intent of Note 1 is to indicate that credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and (continued)

CLINTON B 3.8-18 Revision No. 10-7

AC Sources -Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.10 (continued)

REQUIREMENTS While the DG is not expected to experience this transient during an event and continue to be available, this response ensures that the DG is not degraded for future application, including reconnection to the bus if the trip initiator can be corrected or isolated.

In order to ensure that the DG is tested under load conditions that are as close to design basis conditions as possible, testing must be performed using a power factor

0.9. This power factor is chosen to be representative of the actual design basis inductive loading that the DG would experience.

The 24 month Frequency is consistent with the refuel cycle recommendation of Regulatory Guide 1.9 (Ref. 15) and is intended to be consistent with expected fuel cycle lengths.

This SR has been modified by a Note. The intent of the Note is to indicate that credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and

2) Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

Testing performed for this SR is normally conducted with the DG being tested (and the associated safety-related distribution subsystem) connected to one offsite source, while the remaining safety-related (and non-safety related) distribution systems are aligned to the other offsite source (or unit auxiliary transformers). This minimizes the possibility of common cause failure resulting from offsite/grid voltage perturbations.

This Surveillance should be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite of grid perturbations.

With regard to DG load and voltage values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 23).

(continued)

CLINTON B 3.8-19a Revision No. 10-7

AC Sources--Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.11 (continued)

REQUIREMENTS full flow, or RHR systems performing a decay heat removal function are not desired to be realigned to the ECCS mode of operation. In lieu of actual demonstration of the connection and loading of these loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The Frequency of 24 months is consistent with the refuel cycle recommendations of Regulatory Guide 1.9 (Ref. 15),

takes into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions. Standby conditions mean that the lube oil is heated by the jacket water and continuously circulated through a portion of the system as recommended by the vendor. Engine jacket water is heated by an immersion heater and circulates through the system by natural circulation. This allowance is not intended to impose a maximum limit on engine temperatures. The reason for Note 2 is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge plant safety systems.

Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and

2) Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

(continued)

CLINTON B 3.8-21 Revision No. 10-7

AC Sources--Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.12 REQUIREMENTS (continued) This Surveillance demonstrates that the DG automatically starts and achieves the required voltage and frequency within the specified time (12 seconds) from the design basis actuation signal (LOCA signal) and operates for Ž 5 minutes.

The 5 minute period provides sufficient time to demonstrate stability.

With regard to DG start time, required voltage and frequency values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is not considered to be a nominal value with respect to instrument uncertainties. This requires additional margin to be added to the limit to compensate for instrument uncertainties, for implementation in the associated plant procedures (Refs. 16, 17, 18, 21, 22).

The Frequency of 24 months takes into consideration plant conditions required to perform the Surveillance and is intended to be consistent with the expected fuel cycle lengths. Operating experience has shown that these components usually pass the SR. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions. Standby conditions mean that the lube oil is heated by the jacket water and continuously circulated through a portion of the system as recommended by the vendor. Engine jacket water is heated by an immersion heater and circulates through the system by natural circulation. This allowance is not intended to impose a maximum limit on engine temperatures. The reason for Note 2 is that during operation with the reactor critical, performance of this SR could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, plant safety systems. Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

(continued)

CLINTON B 3. 8-22 Revision No. 10-7

AC Sources--Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.12 (continued)

REQUIREMENTS

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and

2) Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

SR 3.8.1.13 This Surveillance demonstrates that DG non-critical protective functions (e.g., high jacket water temperature) are bypassed on an ECCS initiation test signal and critical protective functions trip the DG to avert substantial damage to the DG unit. The non-critical trips are bypassed during DBAs and provide alarms on abnormal engine conditions.

These alarms provide the operator with necessary information to react appropriately. The DG availability to mitigate the DBA is more critical than protecting the engine against minor problems that are not immediately detrimental to emergency operation of the DG.

The 24 month Frequency is based on engineering judgment, taking into consideration plant conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths. Operating experience has shown that these components usually pass the SR. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

The SR is modified by a Note. The intent of the Note is to indicate that credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and (continued)

CLINTON B 3.8-23 Revision No. 10-7

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.13 (continued)

REQUIREMENTS

2) Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

SR 3.8.1.14 Regulatory Guide 1.9, Revision 3 (Ref. 15) requires demonstration once per 24 months that the DGs can start and run continuously at or near full-load capability for an interval of not less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The DGs are to be loaded equal to or greater than 105 percent of the continuous rating for at least 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and equal to or greater than 90 percent of the continuous rating for the remaining hours of the test (i.e., 22 hours2.546296e-4 days 0.00611 hours 3.637566e-5 weeks 8.371e-6 months ) (Ref. 15). The DG starts for this Surveillance can be performed either from standby or hot conditions. The provisions for prelube and warmup, discussed in SR 3.8.1.2, and for gradual loading, discussed in SR 3.8.1.3, are applicable to this SR.

In order to ensure that the DG is tested under load conditions that are as close to design conditions as possible, testing must be performed using a power factor

< 0.9. This power factor is chosen to be representative of the actual design basis inductive loading that the DG could experience.

The 24 month Frequency is consistent with the refuel cycle recommendations of Regulatory Guide 1.9, Revision 3 (Ref.

15); takes into consideration plant conditions required to perform the Surveillance; and is intended to be consistent with expected fuel cycle lengths.

This Surveillance is modified by two Notes. Note 1 states that momentary transients due to changing bus loads do not invalidate this test. Similarly, momentary power factor transients above the limit do not invalidate the test. The intent of Note 2 is to indicate that credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

(continued)

CLINTON B 3. 8-24 Revision No. 10-7

AC Sources -Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.14 (continued)

REQUIREMENTS

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and

2) Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

Testing performed for this SR is normally conducted with the DG being tested (and the associated safety-related distribution subsystem) connected to one offsite source, while the remaining safety-related (and non-safety related) distribution systems are aligned to the other offsite source (or unit auxiliary transformers). This minimizes the possibility of common cause failures resulting from offsite/grid voltage perturbations.

With regard to DG loading capability values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 19).

SR 3.8.1.15 This Surveillance is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(5), and demonstrates that the diesel engine can restart from a hot condition, such as subsequent to shutdown from normal Surveillances, and achieve the required voltage and frequency within 12 seconds. The 12 second time is derived from the requirements of the accident analysis to respond to a design basis large break LOCA.

With regard to DG loading values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 19).

With regard to DG start time, frequency and voltage values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is not considered to be a nominal value with respect to instrument uncertainties. This requires additional margin to be added to the limit to compensate for instrument uncertainties, for implementation in the associated plant procedures (Refs. 16, 17, 18, 21, 22).

The 24 month Frequency is consistent with the refuel cycle recommendations of Regulatory Guide 1.9, Revision 3 (Ref. 15).

- (continued)

CLINTON B 3.8-25 Revision No. 10-7

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.15 (continued)

REQUIREMENTS This SR has been modified by two Notes. Note 1 ensures that the test is performed with the diesel sufficiently hot. The requirement that the diesel has operated for at least 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months at full load conditions (i.e., equal to or greater than 90 percent of the continuous rating) prior to performance of this Surveillance is based on manufacturer recommendations for achieving hot conditions. Momentary transients due to changing bus loads do not invalidate this test. Note 2 allows all DG starts to be preceded by an engine prelube period to minimize wear and tear on the diesel during testing.

SR 3.8.1.16 As required by Regulatory Guide 1.108 (Ref. 9),

paragraph 2.a.(6), this Surveillance ensures that the manual synchronization and load transfer from the DG to each offsite power source can be made and that the DG can be returned to ready-to-load status when offsite power is restored. It also ensures that the undervoltage logic is reset to allow the DG to reload if a subsequent loss of offsite power occurs. The DG is considered to be in ready-to-load status when the DG is at rated speed and voltage, the output breaker is open and can receive an auto-close signal on bus undervoltage, and the load sequence timers are reset.

Portions of the synchronization circuit are associated with the DG and portions with the offsite circuit. If a failure in the synchronization requirement of the Surveillance occurs, depending on the specific affected portion of the synchronization circuit, either the DG or the associated offsite circuit is declared inoperable.

The Frequency of 24 months is consistent with the refuel cycle recommendations of Regulatory Guide 1.9 (Ref. 15), and takes into consideration plant conditions required to perform the Surveillance.

(continued)

CLINTON B 3.8-26 Revision No. 10-7

AC Sources-Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.16 (continued)

REQUIREMENTS This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems. Credit may be taken for unplanned events that satisfy this SR.

Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and

2) Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

SR 3.8.1.17 Demonstration of the test mode override is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 9),

paragraph 2.a.(8)and ensures that the DG availability under accident conditions is not compromised as the result of testing. Except as clarified below for the Division 3 DG, interlocks to the LOCA sensing circuits cause the DG to automatically reset to ready-to-load operation if an ECCS initiation signal is received during operation in the test mode. Ready-to-load operation is defined as the DG running at rated speed and voltage with the DG output breaker open.

These provisions for automatic switchover are required by IEEE-308 (Ref. 13), paragraph 6.2.6(2), as further amplified by IEEE 387, sections 5.6.1 and 5.6.2. (Clarification regarding conformance of the Division 3 DG design to these standards is provided in the USAR, Chapter 8 (Reference 2).)

Automatic switchover from the test mode to ready-to-load operation for the division 3 DG is also demonstrated, as described above, by ensuring that DG control logic automatically resets in response to a LOCA signal during the test mode and confirming that ready-to-load operation is attained (as evidenced by the DG running with the output breaker open). However, with the DG governor initially operating in a "droop" condition during the test mode, operator action may be required to reset the governor for (continued)

CLINTON B 3.8-27 Revision No. 10-7

U AC Sources--operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.17 (continued)

REQUIREMENTS ready-to-load operation in order to complete the surveillance for the Division 3 DG. Resetting the governor ensures that the DG will supply the Division 3 bus at the required frequency in the event of a LOCA and a loss of offsite power while the DG is in a droop condition during the test mode.

The requirement to automatically energize the emergency loads with offsite power is essentially identical to that of SR 3.8.1.12. The intent in the requirement associated with SR 3.8.1.17.b is to show that the emergency loading is not affected by the DG operation in test mode. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the emergency loads to perform these functions is acceptable.

This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The 24 month Frequency is consistent with the refuel cycle recommendations of Regulatory Guide 1.9 (Ref. 15); takes into consideration plant conditions required to perform the Surveillance; and is intended to be consistent with expected fuel cycle lengths.

This SR has been modified by a Note. The intent of this note is to indicate that credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and

2) Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

Testing performed for this SR is normally conducted with the DG being tested (and the associated safety-related distribution subsystem) connected to one offsite source, while the remaining safety-related (and non-safety related) distribution systems are aligned to the other offsite source (or unit auxiliary transformers). This minimizes the possibility of common cause failures resulting from offsite/grid voltage perturbations.

(continued)

CLINTON B 3.8-28 Revision No. 10-7

AC Sources--Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.18 REQUIREMENTS (continued) Under accident conditions with a loss of offsite power, loads are sequentially connected to the bus by the load sequencing logic (except for Division 3 which has no load sequence timers). The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading of the DGs due to high motor starting currents.

The 10% load sequence time tolerance ensures that sufficient time exists for the DG to restore frequency and voltage prior to applying the next load and that safety analysis assumptions regarding ESF equipment time delays are not violated and is consistent with the recommendations of Regulatory Guide 1.108 (Ref. 9), paragraph 2.a. (2).

Reference 2 provides a summary of the automatic loading of ESF buses.

The Frequency of 24 months is consistent with the refuel cycle recommendations of Regulatory Guide 1.9 (Ref. 15); I takes into consideration plant conditions required to perform the Surveillance; and is intended to be consistent with expected fuel cycle lengths.

This SR is modified by a Note. The reason for the Note is that performing the Surveillance during these MODES may perturb the electrical distribution system, and challenge plant safety systems. Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and

2) Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

With regard to sequence time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 24).

(continued)

CLINTON B 3.8-29 Revision No. 10-7

a AC Sources--Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.19 REQUIREMENTS (continued) In the event of a DBA coincident with a loss of offsite power, the DGs are required to supply the necessary power to ESF systems so that the fuel, RCS, and containment design limits are not exceeded.

This Surveillance demonstrates the DG operation, as discussed in the Bases for SR 3.8.1.11, during a loss of offsite power actuation test signal in conjunction with an ECCS initiation signal. For load shedding effected via shunt trips that are actuated in response to a LOCA signal (i.e., "ECCS initiation signal"), this surveillance includes verification of the shunt trips (for Divisions 1 and 2 only) in response to LOCA signals originating in the ECCS initiation logic as well as the Containment and Reactor Vessel Isolation and Control System actuation logic. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The Frequency of 24 months takes into consideration plant conditions required to perform the Surveillance and is intended to be consistent with an expected fuel cycle length of 24 months.

This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions. Standby conditions mean that the lube oil is heated by the jacket water and continuously circulated through a portion of the system as recommended by the vendor. Engine jacket water is heated by an immersion heater and circulates through the system by natural circulation. This allowance is not intended to impose a maximum limit on engine temperatures. The reason for Note 2 is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge plant safety systems.

Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

(continued)

CLINTON B 3.8-30 Revision No. 10-7

DC Sources -Operating B 3.8.4 BASES SURVEILLANCE REQUIREMENTS (continued) SR 3.8.4.2 This SR verifies the design capacity of the battery chargers. According to Regulatory Guide 1.32 (Ref. 9), the battery charger supply is recommended to be based on the largest combined demands of the various steady state loads and the charging capacity to restore the battery from the design minimum charge state to the fully charged state, irrespective of the status of the unit during these demand occurrences. The minimum required amperes and duration ensure that these requirements can be satisfied. This SR provides two options. One option requires that each battery charger be capable of supplying 300 amps for Divisions 1 and 2 (100 amps for Divisions 3 and 4) at the minimum established float voltage for 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The ampere requirements are based on the output rating of the chargers.

The voltage requirements are based on the charger voltage level after a response to a loss of AC power. The time period is sufficient for the charger temperature to have stabilized and to have been maintained for at least 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

The other option requires that each battery charger be capable of recharging the battery after a service test coincident with supplying the largest coincident demands of the various continuous steady state loads (irrespective or the status of the plant during which these demands occur).

This level of loading may not normally be available following the battery service test and will need to be supplemented with additional loads. The duration for this test may be longer than the charger sizing criteria since the battery recharge is affected by float voltage, temperature, and the exponential decay in charging current.

The battery is recharged when the measured charging current is < 2 amps.

The Surveillance Frequency is acceptable, given the unit conditions required to perform the test and the other administrative controls existing to ensure adequate charger performance during these 24 month intervals. In addition, this Frequency is intended to be consistent with expected fuel cycle lengths.

With regard to minimum required amperes and duration values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 12).

(continued)

CLINTON B 3.8-56 Revision No. 10-7

DC Sources-Operating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.3 REQUIREMENTS (continued)

A battery service test is a special test of the battery's capability, as found, to satisfy the design requirements (battery duty cycle) of the DC electrical power system. The discharge rate and test length are established with a dummy load that corresponds to the design duty cycle requirements as specified in Reference 4.

The Surveillance Frequency of 24 months is an exception to the recommendations of Regulatory Guide 1.32 (Ref. 9) and Regulatory Guide 1.129 (Ref. 10), which state that the battery service test should be performed during refueling operations or at some other outage, with intervals between tests not to exceed 18 months.

This SR is modified by two Notes. Note 1 allows the performance of a modified performance discharge test SR 3.8.6.6 in lieu of SR 3.8.4.3. This substitution is acceptable because SR 3.8.6.6 represents an equivalent test of battery capability as SR 3.8.4.3. The reason for Note 2 is that performing the Surveillance would remove a required DC electrical power subsystem from service, perturb the electrical distribution system, and challenge safety systems. Credit may be taken for unplanned events that satisfy the Surveillance. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and

2) Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

With regard to battery capacity values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 11).

(continued)

CLINTON B 3.8-57 Revision No. 10-7

SVC Protection Systems B 3.8.11 BASES (continued)

APPLICABILITY An SVC Protection System must be OPERABLE whenever its associated SVC is in operation, i.e., whenever the SVC's associated offsite circuit is energized with the SVC connected. Although the plant ESF busses are normally aligned together and to either the RAT or ERAT, an SVC Protection System must be OPERABLE if its associated SVC is connected to the associated auxiliary transformer (RAT or ERAT); the transformer is energized by the offsite network; and the transformer is supplying power to at least one ESF bus, or automatic transfer capability to that transformer exists such that it could supply power to at least one ESF bus.

The requirements for the offsite electrical power sources are addressed in LCO 3.8.1, "AC Sources-Operating," and LCO 3.8.2, "AC Sources-Shutdown."

ACTIONS A.1 With one SVC protection subsystem of a required SVC Protection System inoperable, the inoperable subsystem must be restored to OPERABLE status within 30 days. With the SVC Protection System in this condition, the remaining subsystem is adequate to provide the protection function. However, the overall reliability of the SVC Protection System is reduced because a failure of the OPERABLE subsystem would result in a loss of the SVC failure protection function.

The 30-day Completion Time is based on the low probability of an SVC failure occurring during this time period, and the fact that the remaining subsystem can provide the required protection function.

I B.1 If both SVC protection subsystems of a required SVC Protection System are inoperable, the backup protection system designed for the SVC is unavailable to provide its protection function. Though not all failure modes of the SVC would necessarily be unprotected or potentially damaging to ESF equipment with the required protection system unavailable, there is a significant increase in calculated risk based on conservative failure assumptions for the SVCs.

Thus, at least one subsystem must be restored to OPERABLE (continued)

CLINTON B 3.8-95 Revision No. 10-3

SVC Protection Systems B 3.8.11 BASES SURVEILLANCE SR 3.8.11.2 (continued)

REQUIREMENTS equipment. System functional testing should thus include satisfactory operation of the associated relays and testing of the sensors for which failure modes would be undetected. As a minimum, SVC protection subsystem actuation capability should be verified for response to signals, actual or simulated, corresponding to the following potential SVC failure modes or conditions:

(1) Overvoltage (2) Undervoltage (3) Phase Unbalance (4) Harmonics (5) Overcurrent The 24-month Frequency is based on the refueling cycle.

REFERENCES 1. 10CFR50, Appendix A, GDC 17.

2. USAR, Chapter 8.

CLINTON B 3.8-97 Revision No. 10-7

U-603781, Transmittal of Revision 10 to the Clinton Power Station Technical Specifications Bases

Text

Subject:

Navigation menu

U-603781, Transmittal of Revision 10 to the Clinton Power Station Technical Specifications Bases

Text

Subject:

Navigation menu

Search